PHP CVE-2026-5675

Q: What is the CVSS score of CVE-2026-5675?

CVE-2026-5675 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19432 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-04-06 cna@vuldb.com

GHSA-wfv2-j65x-gcwf

SQLi PHP

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Apr 06, 2026 - 18:22 euvd

EUVD-2026-19432

Analysis Generated

Apr 06, 2026 - 18:22 vuln.today

CVE Published

Apr 06, 2026 - 18:16 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown part of the file /borrowed_tool.php of the component Parameter Handler. The manipulation of the argument emp results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to manipulate the 'emp' parameter in /borrowed_tool.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability requires valid credentials (PR:L) but has publicly available exploit code, though exploitation probability remains moderate (EPSS indicates P:P status). This is a classic parameter injection flaw in a PHP application with real but constrained risk due to authentication requirements.

Technical ContextAI

The vulnerability stems from improper input validation in the Parameter Handler component of the PHP-based Construction Management System. CWE-74 (Improper Neutralization of Special Elements in Output) indicates the application fails to sanitize user-supplied input before incorporating it into SQL queries. The 'emp' parameter in /borrowed_tool.php is passed directly to database operations without prepared statements or parameterized query mechanisms. This is a common PHP application vulnerability pattern where dynamic SQL concatenation with user input creates injection opportunities. The authenticated-only attack surface (PR:L per CVSS vector) suggests the application enforces login before reaching the vulnerable endpoint, limiting exposure to users with valid credentials.

RemediationAI

Primary remediation requires upgrading itsourcecode Construction Management System beyond version 1.0; contact itsourcecode.com for patch availability and upgrade instructions, as no specific patched version is confirmed in available data. Immediate mitigations include: implement parameterized queries or prepared statements for all database interactions in /borrowed_tool.php, conduct code review of the Parameter Handler component to identify and remediate similar injection flaws, apply input validation and output encoding to the 'emp' parameter, and restrict access to the Construction Management System to trusted users with legitimate business need. Refer to vuldb.com/vuln/355501 for detailed vulnerability context and itsourcecode.com for official remediation guidance.