Which versions of PHP are affected by EUVD-2026-13565?

Organizations using A security flaw should be aware of moderate risk from CVE-2026-4470, a injection vulnerability rated CVSS 4.7.

How to fix or mitigate EUVD-2026-13565?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP EUVD-2026-13565

Q: What is the CVSS score of EUVD-2026-13565?

EUVD-2026-13565 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4470 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-20 cna@vuldb.com

PHP SQLi

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.7 (MEDIUM) 2.0 (LOW)

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13565

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 05:16 nvd

MEDIUM 4.7

DescriptionCVE.org

A security flaw has been discovered in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_edit_menu.php. Performing a manipulation of the argument product_name results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in itsourcecode Online Frozen Foods Ordering System 1.0 allows remote attackers with high privileges to manipulate the product_name parameter in /admin/admin_edit_menu.php, enabling unauthorized data access and modification. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. The affected PHP application currently lacks an available patch.

Technical ContextAI

The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as 'Injection'), manifesting specifically as SQL injection in a PHP-based web application. The affected component is the admin_edit_menu.php file within a menu management system, where user-supplied input via the product_name parameter is directly concatenated into SQL queries without proper parameterization or prepared statements. This is a classic PHP/SQL vulnerability pattern where inadequate input validation and lack of parameterized queries allow attackers to break out of the intended SQL context and execute arbitrary database commands.

RemediationAI

The primary remediation is to contact itsourcecode for availability of patches or updates to version 1.0, as no official patch version has been publicly released at this time. If a patched version becomes available, upgrade immediately. In the interim, implement the following compensating controls: restrict administrative access to /admin/admin_edit_menu.php to trusted IP addresses only via firewall or web application firewall rules; enforce strong, unique credentials for all administrative accounts and disable credential sharing; implement input validation and output encoding at the application layer if vendor source code is accessible (specifically, use parameterized SQL queries and escape the product_name parameter); monitor database logs and application logs for suspicious SQL patterns; consider running the application on a segmented network with limited database connectivity. Additionally, review the public POC at https://github.com/sjkdhl/public/issues/3 and https://vuldb.com/?id.351760 to understand the exact attack methodology and verify if your implementation is affected.