itsourcecode Courier Management System CVE-2026-7592

Q: What is the CVSS score of CVE-2026-7592?

CVE-2026-7592 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26710 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-05-01 cna@vuldb.com

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 01, 2026 - 20:31 vuln.today

EUVD ID Assigned

May 01, 2026 - 20:22 euvd

EUVD-2026-26710

Analysis Generated

May 01, 2026 - 20:22 vuln.today

CVE Published

May 01, 2026 - 20:16 nvd

MEDIUM 5.5

DescriptionCVE.org

A weakness has been identified in itsourcecode Courier Management System 1.0. This affects an unknown function of the file /edit_staff.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in itsourcecode Courier Management System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter in /edit_staff.php, potentially leading to unauthorized database access and data disclosure. The vulnerability has a CVSS score of 5.5 with a publicly available exploit, indicating moderate real-world risk despite the low confidentiality impact rating.

Technical ContextAI

The vulnerability exists in a PHP application that handles staff editing functionality through the /edit_staff.php endpoint. The underlying issue is improper input validation on the ID parameter, which fails to sanitize or parameterize user-supplied input before passing it to SQL queries. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as 'Injection') indicates the application does not properly escape or use prepared statements when constructing database queries, allowing attackers to inject arbitrary SQL commands. This is a classic SQL injection flaw in PHP web applications that do not leverage parameterized queries or object-relational mapping frameworks.

RemediationAI

Apply input validation and parameterized queries immediately: modify /edit_staff.php to use prepared statements or parameterized queries (e.g., mysqli_prepare() or PDO prepared statements in PHP) instead of string concatenation for the ID parameter. Additionally, implement strict input whitelisting-the ID parameter should only accept numeric values via regex validation or casting. If an immediate code patch is unavailable from itsourcecode, apply a Web Application Firewall (WAF) rule to block requests containing SQL keywords or special characters in the ID parameter. Update to a patched version of Courier Management System if released by the vendor. Monitor database logs for suspicious query patterns and restrict database account permissions to the minimum required by the application. Contact itsourcecode for security advisory details via https://itsourcecode.com/ or the VulDB record at https://vuldb.com/vuln/360545.