Which versions of PHP are affected by CVE-2026-4780?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4780, a SQL injection vulnerability rated CVSS 5.3.

Is there a public PoC exploit available for CVE-2026-4780?

Yes, a public proof-of-concept exploit is available for CVE-2026-4780. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4780?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4780

Q: What is the CVSS score of CVE-2026-4780?

CVE-2026-4780 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-15031 LOW

SQL Injection (CWE-89)

2026-03-24 VulDB

GHSA-v4c4-58mq-6g8m

PHP SQLi Sales And Inventory System Sourcecodester

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 18:21 vuln.today

Public exploit code

EUVD ID Assigned

Mar 24, 2026 - 23:31 euvd

EUVD-2026-15031

Analysis Generated

Mar 24, 2026 - 23:31 vuln.today

CVE Published

Mar 24, 2026 - 23:11 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was detected in SourceCodester Sales and Inventory System 1.0. Impacted is an unknown function of the file update_out_standing.php of the component HTTP GET Parameter Handler. Performing a manipulation of the argument sid results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

AnalysisAI

SourceCodester Sales and Inventory System 1.0 contains a SQL injection vulnerability in the update_out_standing.php file's sid parameter that allows authenticated remote attackers to execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The vulnerability affects PHP-based deployments and has a CVSS score of 5.3.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-89) affecting a PHP-based web application used for sales and inventory management. The affected component is the HTTP GET Parameter Handler in update_out_standing.php, which fails to properly validate or parameterize the 'sid' (likely 'sales_id' or 'statement_id') input parameter before incorporating it into SQL queries. This allows attackers to break out of the intended query context and inject arbitrary SQL code. The vulnerability affects SourceCodester Sales and Inventory System as identified by CPE cpe:2.3:a:sourcecodester:sales_and_inventory_system:*:*:*:*:*:*:*:*, indicating all versions appear vulnerable. The public proof-of-concept demonstrates the injection technique through direct manipulation of GET parameters sent to the vulnerable endpoint.

RemediationAI

Contact SourceCodester (www.sourcecodester.com) to determine if a patched version is available and upgrade immediately if a patch exists. If no official patch is available from the vendor, implement immediate mitigations: (1) Restrict network access to the application to trusted IP ranges only, (2) Enforce strong authentication and disable account sharing, (3) Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the 'sid' parameter, and (4) Apply input validation on the client and server side to restrict the 'sid' parameter to expected numeric or alphanumeric values only. Additionally, enable SQL query logging to detect exploitation attempts and consider migrating to a actively maintained alternative to SourceCodester Sales and Inventory System if the vendor does not provide timely security updates. The public POC evidence (https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-UpdateOutStanding-sid.md) should inform your incident response team of the exact attack vector for monitoring.