itsourcecode Courier Management System CVE-2026-7612

Q: What is the CVSS score of CVE-2026-7612?

CVE-2026-7612 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26776 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-05-02 cna@vuldb.com

PHP SQLi

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 10:30 vuln.today

EUVD ID Assigned

May 02, 2026 - 10:22 euvd

EUVD-2026-26776

Analysis Generated

May 02, 2026 - 10:22 vuln.today

CVE Published

May 02, 2026 - 10:16 nvd

LOW 2.0

DescriptionCVE.org

A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in itsourcecode Courier Management System 1.0 allows high-privilege remote attackers to manipulate the ID parameter in /edit_user.php, leading to unauthorized database queries with limited confidentiality and integrity impact. Exploit code has been publicly disclosed, though the CVSS 4.0 score of 2.0 and requirement for high-privilege authentication significantly constrain real-world risk.

Technical ContextAI

The vulnerability is a SQL injection flaw (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) in a PHP-based user management endpoint. The /edit_user.php file fails to properly sanitize or parameterize the ID parameter before incorporating it into SQL queries. This allows an attacker with high-privilege credentials to craft malicious SQL syntax to modify query logic, potentially extracting or modifying user data in the underlying database. The attack vector is network-based with low complexity, indicating no special protocol exploitation or client-side tricks are required once authenticated.

RemediationAI

Apply vendor patches if available by contacting itsourcecode (https://itsourcecode.com/) or monitoring their advisory channels. If no official patch exists, implement input validation and parameterized queries in /edit_user.php: replace direct string concatenation of the ID parameter with prepared statements or stored procedures using parameter binding. Additionally, restrict access to /edit_user.php to authenticated administrators via IP whitelisting or network segmentation, and implement rate limiting on user modification endpoints. Disable or restrict high-privilege user accounts if a compromise is suspected. Code review of all user-input handling in the application is recommended. Note that these controls do not fully mitigate the vulnerability-code-level remediation via patching remains the authoritative fix.