Which versions of PHP are affected by CVE-2026-4572?

Organizations using A weakness should be aware of moderate risk from CVE-2026-4572, a SQL injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4572?

Yes, a public proof-of-concept exploit is available for CVE-2026-4572. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4572?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4572

Q: What is the CVSS score of CVE-2026-4572?

CVE-2026-4572 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14359 LOW

SQL Injection (CWE-89)

2026-03-23 VulDB

PHP SQLi Sales And Inventory System Sourcecodester

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 10, 2026 - 01:04 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 05:15 euvd

EUVD-2026-14359

Analysis Generated

Mar 23, 2026 - 05:15 vuln.today

CVE Published

Mar 23, 2026 - 04:18 nvd

MEDIUM 5.3

DescriptionCVE.org

A weakness has been identified in SourceCodester Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /view_product.php of the component HTTP POST Request Handler. Executing a manipulation of the argument searchtxt can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in SourceCodester Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the searchtxt parameter in /view_product.php, enabling unauthorized data access and modification. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

The vulnerability is rooted in improper input validation of the 'searchtxt' POST parameter in a PHP-based web application (Sales and Inventory System). The affected component (HTTP POST Request Handler) fails to implement prepared statements or proper parameterized queries when constructing SQL commands, allowing attackers to inject malicious SQL syntax directly into database queries. This is a classic instance of CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), which occurs when user-supplied input is concatenated directly into SQL strings without escaping or sanitization. The PHP application likely uses unsecured string concatenation or legacy MySQL APIs without parameterized query support, as indicated by the product's legacy status and public PoC availability on GitHub.

RemediationAI

Immediate remediation requires upgrading SourceCodester Sales and Inventory System to a patched version if available; consult https://www.sourcecodester.com/ for security updates and supported versions. If no patch is available, implement input validation by enforcing whitelist-based filtering on the 'searchtxt' parameter to reject SQL metacharacters, and refactor the /view_product.php POST handler to use prepared statements with parameterized queries instead of string concatenation. As a temporary mitigation, restrict network access to the application using a Web Application Firewall (WAF) with SQL injection detection rules, enforce strict authentication controls, and monitor database logs for suspicious query patterns. Additionally, run a security audit of other user-input parameters in the application to identify similar SQL injection vulnerabilities.