PHP EUVD-2026-17733

Q: What is the CVSS score of EUVD-2026-17733?

EUVD-2026-17733 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5238 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-04-01 cna@vuldb.com

GHSA-3cpc-j68r-gc8v

SQLi PHP

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

EUVD ID Assigned

Apr 01, 2026 - 00:22 euvd

EUVD-2026-17733

Analysis Generated

Apr 01, 2026 - 00:22 vuln.today

CVE Published

Apr 01, 2026 - 00:16 nvd

MEDIUM 6.9

DescriptionCVE.org

A weakness has been identified in itsourcecode Payroll Management System 1.0. Affected by this issue is some unknown functionality of the file /view_employee.php of the component Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in itsourcecode Payroll Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via manipulation of the ID parameter in /view_employee.php. The vulnerability has a CVSS score of 6.9 and publicly available exploit code exists, enabling potential data extraction, modification, or authentication bypass without requiring user interaction.

Technical ContextAI

The vulnerability resides in the Parameter Handler component of /view_employee.php, which fails to properly sanitize user-supplied input before constructing SQL queries. This is a classic case of CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), where unsanitized ID parameter values are concatenated directly into SQL statements. The affected product is itsourcecode Payroll Management System version 1.0, a PHP-based web application. The lack of parameterized queries or input validation in the parameter handling logic allows attackers to inject arbitrary SQL syntax, compromising the confidentiality, integrity, and potentially availability of the underlying database.

RemediationAI

Update itsourcecode Payroll Management System to a patched version released by the vendor. Immediate mitigations include implementing parameterized SQL queries (prepared statements) in the /view_employee.php Parameter Handler component to prevent SQL injection, applying strict input validation and whitelist filtering to the ID parameter, and deploying a Web Application Firewall (WAF) with SQL injection detection rules. Consult the vendor advisory at https://itsourcecode.com/ for official patched versions and security guidance. The public exploit referenced at https://github.com/K4ptor/itsourcecode-Payroll-Management-System-V1.0-SQL-Injection2 documents the attack vector and should be reviewed by the development team to ensure the fix adequately addresses this specific parameter injection point.