Which versions of PHP are affected by CVE-2026-4779?

Organizations using A security vulnerability should be aware of moderate risk from CVE-2026-4779, a SQL injection vulnerability rated CVSS 5.3.

Is there a public PoC exploit available for CVE-2026-4779?

Yes, a public proof-of-concept exploit is available for CVE-2026-4779. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4779?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4779

Q: What is the CVSS score of CVE-2026-4779?

CVE-2026-4779 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-15029 LOW

SQL Injection (CWE-89)

2026-03-24 VulDB

PHP SQLi Sales And Inventory System Sourcecodester

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 18:20 vuln.today

Public exploit code

EUVD ID Assigned

Mar 24, 2026 - 22:46 euvd

EUVD-2026-15029

Analysis Generated

Mar 24, 2026 - 22:46 vuln.today

CVE Published

Mar 24, 2026 - 22:22 nvd

MEDIUM 5.3

DescriptionCVE.org

A security vulnerability has been detected in SourceCodester Sales and Inventory System 1.0. This issue affects some unknown processing of the file update_customer_details.php of the component HTTP GET Parameter Handler. Such manipulation of the argument sid leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in SourceCodester Sales and Inventory System 1.0 via the sid parameter in update_customer_details.php allows authenticated remote attackers to execute arbitrary SQL commands. Public exploit code exists for this vulnerability, and no patch is currently available. Affected organizations using PHP-based deployments of this system should restrict access to the vulnerable component until a fix is released.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-89) in a PHP-based web application. The update_customer_details.php component fails to properly sanitize or parameterize the 'sid' HTTP GET parameter before incorporating it into SQL queries. According to CPE designation (cpe:2.3:a:sourcecodester:sales_and_inventory_system:*:*:*:*:*:*:*:*), this affects the Sales and Inventory System product line. The root cause is insufficient input validation on user-controlled parameters passed directly to database query construction, a fundamental PHP/web application security flaw that bypasses database access controls.

RemediationAI

The primary remediation is to upgrade SourceCodester Sales and Inventory System to a patched version released after this disclosure; check the vendor website at https://www.sourcecodester.com/ for available updates. Immediate mitigation pending patches includes implementing parameterized queries or prepared statements for all database interactions, particularly in update_customer_details.php, and enforcing strict input validation on the 'sid' parameter using whitelist validation. Additionally, restrict database user permissions to the minimum required scope, implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in GET parameters, and isolate the application behind a reverse proxy with HTTPS enforcement. Monitor database query logs for suspicious activity patterns indicative of exploitation attempts.