Which versions of PHP are affected by CVE-2026-4876?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4876, a SQL injection vulnerability rated CVSS 5.3.

Is there a public PoC exploit available for CVE-2026-4876?

Yes, a public proof-of-concept exploit is available for CVE-2026-4876. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4876?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4876

Q: What is the CVSS score of CVE-2026-4876?

CVE-2026-4876 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16193 LOW

SQL Injection (CWE-89)

2026-03-26 VulDB

PHP SQLi Free Hotel Reservation System Itsourcecode

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 13:45 euvd

EUVD-2026-16193

Analysis Generated

Mar 26, 2026 - 13:45 vuln.today

CVE Published

Mar 26, 2026 - 13:05 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in itsourcecode Free Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/mod_amenities/index.php?view=editpic. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Free Hotel Reservation System 1.0 via the ID parameter in /admin/mod_amenities/index.php?view=editpic allows authenticated remote attackers to manipulate database queries and extract or modify sensitive data. The vulnerability requires valid administrator credentials to exploit (PR:L per CVSS 4.0 vector), affects confidentiality and integrity of database contents, and carries moderate real-world risk despite a CVSS score of 5.3 due to publicly available exploit code and low attack complexity. No vendor-released patch has been identified; the system appears to be unsupported or abandoned based on available advisory data.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) flaw in PHP-based web application logic. Specifically, the /admin/mod_amenities/index.php endpoint fails to properly sanitize or parameterize the ID parameter when processing the editpic view operation, allowing attackers to inject arbitrary SQL commands. The affected product is itsourcecode Free Hotel Reservation System (CPE: cpe:2.3:a:itsourcecode:free_hotel_reservation_system:*:*:*:*:*:*:*:*), version 1.0. SQL injection attacks typically exploit inadequate input validation and string concatenation in database query construction, permitting attackers to read, modify, or delete database records depending on database permissions and query context. The admin panel context suggests the application uses role-based access control, but the authentication check does not prevent SQL injection once an admin session is established.

RemediationAI

No vendor-released patched version of itsourcecode Free Hotel Reservation System has been identified at the time of analysis; the software appears to be unmaintained. Organizations deploying this system must immediately upgrade to an alternative, actively maintained hotel reservation platform or implement compensating controls. If immediate migration is not feasible, implement the following mitigations: (1) Restrict network access to the /admin/mod_amenities/index.php endpoint to a whitelist of trusted administrative IP addresses via WAF or reverse proxy rules; (2) enforce strong, unique administrator credentials and enforce multi-factor authentication for all admin panel access; (3) enable SQL error suppression and implement parameterized queries or prepared statements if source code is available for modification; (4) deploy a Web Application Firewall (WAF) configured with SQL injection detection signatures to block requests containing SQL metacharacters in the ID parameter; (5) maintain comprehensive database activity logging and audit access to the amenities table. Consult the VulDB advisory at https://vuldb.com/?id.353559 and the GitHub PoC at https://github.com/bybinyu/Vulnerability-Practice/issues/5 for additional technical details.