Which versions of PHP are affected by CVE-2026-4966?

Organizations using A flaw should be aware of moderate risk from CVE-2026-4966, a SQL injection vulnerability rated CVSS 5.3.

Is there a public PoC exploit available for CVE-2026-4966?

Yes, a public proof-of-concept exploit is available for CVE-2026-4966. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4966?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4966

Q: What is the CVSS score of CVE-2026-4966?

CVE-2026-4966 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16738 LOW

SQL Injection (CWE-89)

2026-03-27 VulDB

PHP SQLi Free Hotel Reservation System Itsourcecode

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 18:00 euvd

EUVD-2026-16738

Analysis Generated

Mar 27, 2026 - 18:00 vuln.today

CVE Published

Mar 27, 2026 - 17:41 nvd

MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in itsourcecode Free Hotel Reservation System 1.0. Impacted is an unknown function of the file /admin/mod_room/index.php?view=edit. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

AnalysisAI

SQL injection in itsourcecode Free Hotel Reservation System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/mod_room/index.php?view=edit, leading to unauthorized database query execution. The vulnerability requires valid admin credentials (CVSS PR:L) but has publicly available exploit code and represents a moderate information disclosure and integrity risk (CVSS 5.3 with limited confidentiality, integrity, and availability impact). Active exploitation status is not confirmed via CISA KEV, but proof-of-concept code is documented in public repositories.

Technical ContextAI

The vulnerability stems from improper input validation in a PHP-based hotel reservation management application. The root cause is CWE-89 (SQL Injection), specifically insufficient sanitization of the ID parameter before incorporation into SQL queries within the admin room management module. The affected product cpe:2.3:a:itsourcecode:free_hotel_reservation_system:*:*:*:*:*:*:*:* indicates all versions of the Free Hotel Reservation System are potentially vulnerable. The flaw exists in server-side PHP code that processes HTTP GET or POST requests to the administrative interface without adequate parameterized query protection or input validation.

RemediationAI

Contact itsourcecode directly via https://itsourcecode.com/ to obtain any available security patches or updated versions for the Free Hotel Reservation System. Until a patch is available, restrict administrative access to the application through network segmentation, limit admin panel exposure to trusted IP ranges via firewall or reverse proxy rules, and enforce strong authentication mechanisms on admin accounts. Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the ID parameter of requests to /admin/mod_room/index.php. Consider disabling the room management feature if not actively required. Review access logs for suspicious database queries and monitor for unauthorized data extraction.