Which versions of PHP are affected by CVE-2026-4838?

A critical SQL injection vulnerability in SourceCodester Malawi Online Market v1.0 allows unauthenticated attackers to execute arbitrary database commands, threatening customer data, transaction…

Is there a public PoC exploit available for CVE-2026-4838?

Yes, a public proof-of-concept exploit is available for CVE-2026-4838. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4838?

Within 24 hours: Inventory all systems running SourceCodester Malawi Online Market v1.0 and assess exposure; immediately implement WAF rules to block SQL injection patterns targeting /display.php; consider taking the affected application offline if exploitable and internet-facing. Within 7 days: Deploy network segmentation to isolate affected systems; implement enhanced database activity monitoring and logging; conduct vulnerability scanning for similar weaknesses; communicate risk status to affected customers if applicable. Within 30 days: Identify and implement vendor patches or security updates; evaluate migration to patched/alternative solutions; conduct forensic audit for evidence of exploitation; complete remediation validation testing.

PHP CVE-2026-4838

Q: What is the CVSS score of CVE-2026-4838?

CVE-2026-4838 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16082 MEDIUM

SQL Injection (CWE-89)

2026-03-26 VulDB

GHSA-m75r-w8f2-6h95

PHP SQLi Malawi Online Market Sourcecodester

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 03:45 euvd

EUVD-2026-16082

Analysis Generated

Mar 26, 2026 - 03:45 vuln.today

CVE Published

Mar 26, 2026 - 02:31 nvd

MEDIUM 6.9

DescriptionCVE.org

A flaw has been found in SourceCodester Malawi Online Market 1.0. The impacted element is an unknown function of the file /display.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

AnalysisAI

SQL injection in SourceCodester Malawi Online Market 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /display.php and execute arbitrary database queries. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. The vulnerability remains unpatched and affects PHP-based deployments of this application.

Technical ContextAI

This vulnerability affects SourceCodester Malawi Online Market 1.0 (CPE: cpe:2.3:a:sourcecodester:malawi_online_market:*:*:*:*:*:*:*:*), a PHP-based e-commerce application. The flaw is classified as CWE-89 (SQL Injection), which occurs when user-supplied input is incorporated into SQL queries without proper validation or parameterization. The /display.php file accepts an ID parameter that is directly concatenated into database queries, allowing attackers to inject malicious SQL syntax. This is a classic example of improper input validation in web applications where developers fail to implement prepared statements or proper escaping mechanisms for database interactions.

RemediationAI

Organizations running Malawi Online Market 1.0 should immediately review the vendor website at https://www.sourcecodester.com/ for any available security patches or updated versions that address this SQL injection flaw. If no patch is available, implement immediate mitigations including deploying a web application firewall (WAF) with SQL injection detection rules specifically targeting the /display.php endpoint and ID parameter, restricting application access to authenticated users only through network segmentation or authentication layers, and implementing input validation at the web server or reverse proxy level to block common SQL injection patterns. Consider replacing this software with a maintained alternative if the vendor does not provide timely security updates. Database permissions should be reviewed to ensure the application operates with minimal privileges using the principle of least privilege.