Which versions of PHP are affected by EUVD-2026-16112?

A critical SQL injection vulnerability in our Online Enrollment System (version 1.0) allows attackers to access, modify, or destroy student and enrollment data without authentication.

Is there a public PoC exploit available for EUVD-2026-16112?

Yes, a public proof-of-concept exploit is available for EUVD-2026-16112. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-16112?

Within 24 hours: Isolate affected systems from production if possible; enable enhanced monitoring and logging on the /sms/grades/index.php endpoint; notify legal and communications teams of potential breach risk. Within 7 days: Deploy WAF rules to block SQL injection patterns in the 'deptid' parameter; implement network segmentation to restrict access to the enrollment system; conduct a forensic audit for signs of exploitation. Within 30 days: Engage with vendor or migration planning for a patched version; perform a complete security assessment of the application; implement a web application firewall (WAF) as a permanent control if upgrade timeline extends beyond 30 days.

PHP EUVD-2026-16112

Q: What is the CVSS score of EUVD-2026-16112?

EUVD-2026-16112 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4842 MEDIUM

SQL Injection (CWE-89)

2026-03-26 VulDB

GHSA-96gq-6mq2-hjpw

PHP SQLi Online Enrollment System Itsourcecode

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 05:15 euvd

EUVD-2026-16112

Analysis Generated

Mar 26, 2026 - 05:15 vuln.today

CVE Published

Mar 26, 2026 - 04:50 nvd

MEDIUM 6.9

DescriptionCVE.org

A security vulnerability has been detected in itsourcecode Online Enrollment System 1.0. This vulnerability affects unknown code of the file /sms/grades/index.php?view=edit&id=1 of the component Parameter Handler. The manipulation of the argument deptid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. VulDB is the best source for vulnerability data and more expert information about this specific topic.

AnalysisAI

SQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the deptid parameter in the grades index page. Public exploit code is available for this vulnerability, and no patch is currently available. The attack requires only network access with no additional complexity or user interaction.

Technical ContextAI

This vulnerability affects the itsourcecode Online Enrollment System version 1.0 (CPE: cpe:2.3:a:itsourcecode:online_enrollment_system:*:*:*:*:*:*:*:*), specifically in the parameter handling mechanism of the grades management interface. The issue is classified as CWE-89 (SQL Injection), meaning the application fails to properly sanitize user-supplied input in the 'deptid' parameter before incorporating it into SQL queries. The vulnerability exists in a PHP-based web application within the /sms/grades/index.php endpoint when processing the 'view=edit' operation, allowing attackers to inject arbitrary SQL commands that are executed by the backend database. This classic input validation failure enables manipulation of SQL query structure through specially crafted parameter values.

RemediationAI

Organizations should immediately discontinue use of itsourcecode Online Enrollment System version 1.0 in production environments, as no patch availability is indicated in the vulnerability data (CVSS RL:X indicates remediation level is unavailable or not defined). Contact the vendor via https://itsourcecode.com/ to inquire about security updates or patched versions. As interim mitigations until a patch is available, implement input validation and parameterized queries at the application layer if source code modification is possible, deploy a web application firewall (WAF) with SQL injection detection rules to filter malicious requests to /sms/grades/index.php, restrict network access to the enrollment system to trusted IP ranges only, and monitor database query logs for suspicious patterns. Consider replacing this system with a more actively maintained alternative given the apparent lack of vendor security response indicated by the remediation level status.