Which versions of PHP are affected by EUVD-2026-12361?

A critical SQL injection vulnerability in the Payroll Management System allows unauthenticated attackers to access, modify, or delete sensitive employee payroll data.

Is there a public PoC exploit available for EUVD-2026-12361?

Yes, a public proof-of-concept exploit is available for EUVD-2026-12361. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-12361?

Within 24 hours: Identify all systems running Payroll Management System 1.0, isolate affected instances from production networks if possible, and implement emergency access controls. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns targeting /manage_employee.php, implement input validation at the application layer, and restrict access to the application by IP whitelist. Within 30 days: Contact itsourcecode for patch availability and timeline; evaluate alternative payroll solutions; conduct full audit of payroll database access logs for unauthorized activity.

PHP EUVD-2026-12361

Q: What is the CVSS score of EUVD-2026-12361?

EUVD-2026-12361 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4223 MEDIUM

SQL Injection (CWE-89)

2026-03-16 VulDB

PHP SQLi Payroll Management System Itsourcecode

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

PoC Detected

Mar 20, 2026 - 12:52 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 09:00 euvd

EUVD-2026-12361

Analysis Generated

Mar 16, 2026 - 09:00 vuln.today

CVE Published

Mar 16, 2026 - 07:02 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was identified in itsourcecode Payroll Management System 1.0. This issue affects some unknown processing of the file /manage_employee.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Payroll Management System 1.0 via the ID parameter in /manage_employee.php allows unauthenticated remote attackers to execute arbitrary SQL queries and access or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available. Organizations running this system should implement network-level protections and consider upgrading to a patched version once released.

Technical ContextAI

The vulnerability affects the Payroll Management System version 1.0 developed by itsourcecode, a PHP-based web application for managing employee payroll data. The CPE identifier cpe:2.3:a:itsourcecode:payroll_management_system:*:*:*:*:*:*:*:* confirms this is a web application vulnerability. As classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), the issue stems from insufficient input validation where user-supplied data in the ID parameter is directly incorporated into SQL queries without proper sanitization or parameterization, allowing attackers to inject malicious SQL statements.

RemediationAI

No patch or updated version is currently available from itsourcecode for this vulnerability. Organizations should immediately implement web application firewall (WAF) rules to filter SQL injection attempts targeting the /manage_employee.php endpoint, particularly monitoring the ID parameter for malicious payloads. As an interim measure, restrict network access to the Payroll Management System to trusted IP ranges only and implement strong authentication. Given the critical nature of payroll data and lack of vendor patch, consider migrating to a more secure payroll management solution with active security support. Monitor https://vuldb.com/?id.351147 for any updates on patch availability.