PHP CVE-2026-5575

Q: What is the CVSS score of CVE-2026-5575?

CVE-2026-5575 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19099 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-04-05 cna@vuldb.com

SQLi PHP

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

EUVD ID Assigned

Apr 05, 2026 - 15:22 euvd

EUVD-2026-19099

Analysis Generated

Apr 05, 2026 - 15:22 vuln.today

CVE Published

Apr 05, 2026 - 15:16 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was detected in SourceCodester/jkev Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file index.php of the component Login. The manipulation of the argument Username results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester jkev Record Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter in the Login component (index.php) to execute arbitrary SQL queries, potentially leading to unauthorized data access or modification. The exploit code is publicly available, and the vulnerability carries a CVSS 4.0 base score of 6.9 with low confidentiality, integrity, and availability impact.

Technical ContextAI

The vulnerability exists in the Login functionality of index.php within the jkev Record Management System, a PHP-based web application. The root cause is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which indicates inadequate input validation and output encoding. The Username parameter is passed to a database query without proper sanitization or prepared statement usage, allowing attackers to inject arbitrary SQL commands. This is a classic first-order SQL injection vulnerability where user input is directly concatenated into SQL queries executed against the application's database backend.

RemediationAI

Immediate remediation requires upgrading to a patched version of jkev Record Management System if available from SourceCodester; however, no vendor-released patch version was identified at time of analysis. As an interim measure, implement input validation and parameterized queries (prepared statements) for all database operations, particularly in the Login component's Username parameter handling. Apply Web Application Firewall (WAF) rules to detect and block SQL injection patterns in authentication requests. Enforce principle of least privilege for database accounts used by the application. Consider implementing rate limiting on failed login attempts to reduce brute-force and injection testing vectors. Review the VulDB submission (vuldb.com/submit/783472) and the GitHub CVE documentation for technical remediation guidance specific to this codebase.