Which versions of PHP are affected by CVE-2026-4632?

A critical SQL injection vulnerability in the itsourcecode Online Enrollment System allows unauthenticated attackers to remotely access, modify, or delete sensitive database records.

Is there a public PoC exploit available for CVE-2026-4632?

Yes, a public proof-of-concept exploit is available for CVE-2026-4632. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4632?

Within 24 hours: Take the affected enrollment system offline or restrict network access to authorized personnel only; notify all stakeholders of the service disruption. Within 7 days: Deploy compensating controls including WAF rules to block SQL injection patterns, implement input validation at the application layer, and conduct forensic analysis for signs of exploitation. Within 30 days: Either upgrade to a patched version when available, migrate to an alternative enrollment system, or implement a complete application redesign with secure coding practices.

PHP CVE-2026-4632

Q: What is the CVSS score of CVE-2026-4632?

CVE-2026-4632 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14738 MEDIUM

SQL Injection (CWE-89)

2026-03-24 VulDB

GHSA-763j-4r42-mhxh

PHP SQLi Online Enrollment System Itsourcecode

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Severity Changed

Apr 24, 2026 - 16:37 NVD

HIGH MEDIUM

CVSS changed

Apr 24, 2026 - 16:37 NVD

7.3 (HIGH) 6.9 (MEDIUM)

PoC Detected

Mar 24, 2026 - 15:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 24, 2026 - 04:30 euvd

EUVD-2026-14738

Analysis Generated

Mar 24, 2026 - 04:30 vuln.today

CVE Published

Mar 24, 2026 - 04:09 nvd

HIGH 7.3

DescriptionCVE.org

A weakness has been identified in itsourcecode Online Enrollment System 1.0. This vulnerability affects unknown code of the file /sms/user/index.php?view=add of the component Parameter Handler. Executing a manipulation of the argument Name can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to manipulate the Name parameter in /sms/user/index.php?view=add, potentially enabling unauthorized data access, modification, or deletion. Public exploit code exists for this vulnerability, increasing risk of active exploitation. No patch is currently available.

Technical ContextAI

The vulnerability affects itsourcecode Online Enrollment System 1.0 (CPE: cpe:2.3:a:itsourcecode:online_enrollment_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing student enrollment processes. The root cause is CWE-89 (SQL Injection), where user-supplied input from the 'Name' parameter in the /sms/user/index.php?view=add endpoint is not properly sanitized before being incorporated into SQL queries. This allows attackers to inject malicious SQL commands that are executed by the database server, bypassing intended query logic and security controls. The vulnerability exists in the Parameter Handler component, suggesting improper input validation and lack of parameterized queries or prepared statements in the application's data access layer.

RemediationAI

No official vendor patch or updated version has been identified in the available references, and the Remediation Level (RL:X) in the CVSS vector indicates undefined remediation status. Organizations should immediately restrict network access to the affected /sms/user/index.php endpoint to trusted IP addresses only through firewall rules or web application firewall (WAF) policies. Implement input validation and sanitization for the 'Name' parameter, ideally by modifying the source code to use parameterized queries or prepared statements with bound parameters. Deploy a WAF with SQL injection detection signatures to block exploitation attempts. Consider migrating to alternative enrollment management software with active security support, as the lack of vendor response to this publicly disclosed vulnerability suggests inadequate security maintenance. Monitor database logs and web server access logs for suspicious SQL syntax in request parameters as an interim detection control.