Which versions of PHP are affected by CVE-2026-4825?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4825, a SQL injection vulnerability rated CVSS 5.3.

Is there a public PoC exploit available for CVE-2026-4825?

Yes, a public proof-of-concept exploit is available for CVE-2026-4825. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4825?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4825

Q: What is the CVSS score of CVE-2026-4825?

CVE-2026-4825 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16024 LOW

SQL Injection (CWE-89)

2026-03-25 VulDB

GHSA-phg7-w8vm-9cqf

PHP SQLi Sales And Inventory System Sourcecodester

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 08, 2026 - 18:40 vuln.today

Public exploit code

EUVD ID Assigned

Mar 25, 2026 - 22:47 euvd

EUVD-2026-16024

Analysis Generated

Mar 25, 2026 - 22:47 vuln.today

CVE Published

Mar 25, 2026 - 22:32 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file /update_sales.php of the component HTTP GET Parameter Handler. The manipulation of the argument sid results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in SourceCodester Sales and Inventory System 1.0 via the sid parameter in /update_sales.php allows authenticated remote attackers to execute arbitrary SQL queries and potentially access or modify database contents. Public exploit code exists for this vulnerability and exploitation requires valid user credentials. No patch is currently available.

Technical ContextAI

The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) within a PHP-based web application. The affected component is the HTTP GET Parameter Handler processing the 'sid' argument in /update_sales.php, which constructs SQL queries without proper parameterized statements or input validation. SourceCodester Sales and Inventory System 1.0, identified via CPE (cpe:2.3:a:sourcecodester:sales_and_inventory_system:1.0:*:*:*:*:*:*:*), is a lightweight inventory management application commonly deployed in small business environments. The absence of prepared statements or output encoding allows attackers to inject arbitrary SQL commands through the 'sid' parameter, enabling unauthorized data access or manipulation.

RemediationAI

Immediately upgrade SourceCodester Sales and Inventory System to a patched version if available from the vendor at https://www.sourcecodester.com/; if no patch is available, consider discontinuing use of this software or restricting network access to trusted IP ranges via firewall rules and require VPN authentication before accessing the application. As an urgent interim mitigation, implement Web Application Firewall (WAF) rules to block SQL injection patterns in the 'sid' parameter, enforce strong authentication (multi-factor authentication) for all user accounts, and apply principle of least privilege by restricting database user permissions to SELECT-only where possible. Enable comprehensive SQL query logging and set up alerts for suspicious database access patterns. Conduct a forensic audit of access logs from deployment date to present to identify potential unauthorized data access.