Which versions of PHP are affected by CVE-2026-4781?

Organizations using A flaw should be aware of moderate risk from CVE-2026-4781, a SQL injection vulnerability rated CVSS 5.3.

Is there a public PoC exploit available for CVE-2026-4781?

Yes, a public proof-of-concept exploit is available for CVE-2026-4781. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4781?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4781

Q: What is the CVSS score of CVE-2026-4781?

CVE-2026-4781 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-15033 LOW

SQL Injection (CWE-89)

2026-03-24 VulDB

GHSA-923r-23pf-6337

PHP SQLi Sales And Inventory System Sourcecodester

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 18:23 vuln.today

Public exploit code

EUVD ID Assigned

Mar 24, 2026 - 23:31 euvd

EUVD-2026-15033

Analysis Generated

Mar 24, 2026 - 23:31 vuln.today

CVE Published

Mar 24, 2026 - 23:11 nvd

MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in SourceCodester Sales and Inventory System 1.0. The affected element is an unknown function of the file update_purchase.php of the component HTTP GET Parameter Handler. Executing a manipulation of the argument sid can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

AnalysisAI

SQL injection in SourceCodester Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the sid parameter in update_purchase.php, enabling unauthorized database queries and potential data exfiltration. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

The vulnerability stems from CWE-89 (SQL Injection), a classic input validation failure where user-supplied data from HTTP GET parameters is directly concatenated into SQL queries without proper escaping or parameterized query preparation. The affected component is written in PHP and handles the 'sid' parameter in the update_purchase.php file. The CPE identifier cpe:2.3:a:sourcecodester:sales_and_inventory_system indicates this is a PHP-based web application framework. The root cause is the absence of input validation and the use of unsafe string concatenation in SQL query construction, allowing attackers to break out of the intended query context and inject arbitrary SQL commands.

RemediationAI

Immediately upgrade SourceCodester Sales and Inventory System to a patched version beyond 1.0 if available from https://www.sourcecodester.com/. If a patched version is unavailable or deployment cannot be immediately updated, implement the following interim controls: enforce parameterized prepared statements or stored procedures for all database queries, validate and sanitize all HTTP GET parameters using whitelist-based input validation, apply PHP input filtering functions such as filter_var() or use an ORM framework that handles SQL escaping automatically, and restrict network access to the application to trusted IP ranges only. Additionally, implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts on the update_purchase.php endpoint, and conduct a thorough database audit to detect any unauthorized access or data modification that may have occurred.