Which versions of PHP are affected by EUVD-2026-14660?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4614, a injection vulnerability rated CVSS 6.3.

How to fix or mitigate EUVD-2026-14660?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP EUVD-2026-14660

Q: What is the CVSS score of EUVD-2026-14660?

EUVD-2026-14660 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4614 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-24 cna@vuldb.com

GHSA-4x24-3v7p-2g45

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 24, 2026 - 16:37 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Mar 24, 2026 - 00:22 euvd

EUVD-2026-14660

Analysis Generated

Mar 24, 2026 - 00:22 vuln.today

CVE Published

Mar 24, 2026 - 00:16 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was determined in itsourcecode sanitize or validate this input 1.0. This issue affects some unknown processing of the file /admin/subjects.php of the component Parameter Handler. This manipulation of the argument subject_code causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in the Parameter Handler of itsourcecode sanitize or validate this input 1.0 allows authenticated remote attackers to manipulate the subject_code argument in /admin/subjects.php and execute arbitrary SQL commands. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

The vulnerability stems from improper input validation in the Parameter Handler component of a PHP-based application, specifically within the administrative subjects management functionality. The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which encompasses SQL injection vulnerabilities where user-supplied input in the subject_code parameter is concatenated into SQL queries without parameterized prepared statements or escaping. The affected application itsourcecode appears to be a PHP-based educational or institutional management system hosted at itsourcecode.com, and the vulnerability permits an authenticated user to inject arbitrary SQL commands through the subject_code argument in the /admin/subjects.php endpoint.

RemediationAI

Immediately upgrade itsourcecode to a patched version released after the CVE disclosure; verify availability and version number via the official itsourcecode.com website and the VulDB advisory at https://vuldb.com/?id.352478. Until patching is possible, implement input validation on the subject_code parameter by using parameterized queries or prepared statements in the /admin/subjects.php file, restrict network access to the /admin/ path to trusted IP ranges via firewall or web application firewall rules, enforce strong authentication and session management on admin accounts, and consider disabling the subjects management functionality if unused. Database-level protections such as limiting query privileges for the application account and enabling SQL query logging can provide defense-in-depth.