Which versions of PHP are affected by CVE-2026-4783?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4783, a SQL injection vulnerability rated CVSS 5.3.

Is there a public PoC exploit available for CVE-2026-4783?

Yes, a public proof-of-concept exploit is available for CVE-2026-4783. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4783?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4783

Q: What is the CVSS score of CVE-2026-4783?

CVE-2026-4783 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-15180 LOW

SQL Injection (CWE-89)

2026-03-25 VulDB

PHP SQLi College Management System Itsourcecode

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 25, 2026 - 15:41 vuln.today

Public exploit code

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15180

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/add-single-student-results.php of the component Parameter Handler. The manipulation of the argument course_code leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in the College Management System 1.0 parameter handler allows authenticated attackers to manipulate the course_code argument in /admin/add-single-student-results.php and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires network access and valid credentials but can compromise data confidentiality and integrity.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-89) in PHP-based web application code. The College Management System, identified via CPE cpe:2.3:a:itsourcecode:college_management_system:*:*:*:*:*:*:*:*, fails to properly validate or parameterize the course_code input parameter in the add-single-student-results.php administrative function. This allows an attacker to inject malicious SQL statements that are executed by the backend database engine. The lack of prepared statements, input validation, or output encoding creates the attack surface. As a Parameter Handler component vulnerability, the flaw exists in the request processing layer before data reaches the database abstraction layer.

RemediationAI

Immediately upgrade itsourcecode College Management System to the latest patched version available from https://itsourcecode.com/ or GitHub. Until patching is completed, implement the following mitigations: (1) restrict access to /admin/add-single-student-results.php via IP allowlisting on the web server or WAF, limiting administrative endpoints to trusted office networks or VPN ranges, (2) enforce strong multi-factor authentication for all administrative accounts to reduce the likelihood of credential compromise and unauthorized access, (3) implement parameterized queries or prepared statements for all database interactions (use PHP PDO or mysqli prepared statements), and (4) deploy a Web Application Firewall (WAF) configured with SQL injection detection rules to block payloads containing SQL keywords and syntax variations. Monitor database query logs and application logs for suspicious activity patterns indicative of SQL injection attempts.