Which versions of PHP are affected by CVE-2026-4573?

Organizations using A security vulnerability should be aware of moderate risk from CVE-2026-4573, a SQL injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4573?

Yes, a public proof-of-concept exploit is available for CVE-2026-4573. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4573?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4573

Q: What is the CVSS score of CVE-2026-4573?

CVE-2026-4573 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14363 LOW

SQL Injection (CWE-89)

2026-03-23 VulDB

GHSA-wcm9-77g7-g8p2

PHP SQLi Simple E Learning System Sourcecodester

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 24, 2026 - 16:37 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 05:45 euvd

EUVD-2026-14363

Analysis Generated

Mar 23, 2026 - 05:45 vuln.today

CVE Published

Mar 23, 2026 - 05:01 nvd

MEDIUM 6.3

DescriptionCVE.org

A security vulnerability has been detected in SourceCodester Simple E-learning System 1.0. This affects an unknown part of the file /includes/form_handlers/delete_post.php of the component HTTP GET Parameter Handler. The manipulation of the argument post_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in SourceCodester Simple E-learning System 1.0 allows authenticated attackers to manipulate the post_id parameter in the delete_post.php endpoint, enabling unauthorized data access, modification, or deletion. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-89) occurring in PHP-based web application code handling HTTP GET parameters. Specifically, the /includes/form_handlers/delete_post.php component fails to properly validate or parameterize the post_id parameter before embedding it into SQL queries, allowing an attacker to inject malicious SQL syntax. The affected product is SourceCodester Simple E-learning System (cpe:2.3:a:sourcecodester:simple_e-learning_system:*:*:*:*:*:*:*:*), a PHP-based educational platform. Without prepared statements or input validation, user-controlled input directly shapes the query logic, enabling attackers to enumerate databases, extract sensitive data, or modify records.

RemediationAI

Immediate action requires upgrading SourceCodester Simple E-learning System to a patched version released after version 1.0; however, no specific patched version is documented in available sources—contact SourceCodester support at https://www.sourcecodester.com/ to obtain a security update or determine if version 1.0 is still maintained. As an interim mitigation pending patching, enforce strict parameterized queries (prepared statements) in delete_post.php by rewriting the post_id parameter handling to use bound parameters rather than string concatenation. Additionally, restrict HTTP GET access to the delete_post.php handler through application-level authorization checks, implement web application firewall (WAF) rules to detect and block SQL injection payloads in the post_id parameter, and audit database user permissions to limit the damage scope if injection succeeds. Monitor web server and database logs for suspicious query patterns or failed DELETE operations.