What is the CVSS score of EUVD-2026-21391?

EUVD-2026-21391 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-21391?

itsourcecode Online Student Enrollment System v1.0 contains a critical SQL injection vulnerability allowing unauthenticated attackers to compromise the entire student database, bypass authentication…

How to fix or mitigate EUVD-2026-21391?

Within 24 hours: identify all instances of itsourcecode Online Student Enrollment System v1.0 in production and isolate affected systems from external network access; document all connected data sources and student records affected. Within 7 days: implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting assignInstructorSubjects.php 'subjcode' parameter; conduct forensic review of database logs for unauthorized access dating back 90 days. Within 30 days: evaluate vendor alternatives or upgrade to patched version if available; if no patch emerges, plan decommissioning of the application and migrate student data to replacement system with security assessment.

PHP EUVD-2026-21391

| CVE-2026-36233 CRITICAL

SQL Injection (CWE-89)

2026-04-10 mitre

GHSA-mcv5-wpqg-r546

PHP SQLi

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 15:24 vuln.today

CVSS changed

Apr 14, 2026 - 15:22 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 10, 2026 - 15:15 euvd

EUVD-2026-21391

CVE Published

Apr 10, 2026 - 00:00 nvd

N/A

DescriptionCVE.org

A SQL injection vulnerability was found in the assignInstructorSubjects.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that attackers can inject malicious code via the parameter "subjcode" and use it directly in SQL queries without the need for appropriate cleaning or validation.

AnalysisAI

SQL injection in itsourcecode Online Student Enrollment System v1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'subjcode' parameter in assignInstructorSubjects.php, potentially enabling complete database compromise, authentication bypass, and data exfiltration. CVSS 9.8 (Critical) reflects network-accessible exploitation requiring no privileges or user interaction. EPSS score of 0.01% (2nd percentile) indicates minimal observed exploitation activity, though publicly available exploit code exists via GitHub repository documentation. No vendor-released patch identified at time of analysis.

Technical ContextAI

This vulnerability exploits CWE-89 (SQL Injection), a classic input validation failure where user-controlled data flows directly into SQL query construction without parameterization or sanitization. The assignInstructorSubjects.php endpoint in this PHP-based enrollment management system accepts the 'subjcode' parameter and concatenates it into SQL statements without using prepared statements or input escaping. Attackers can inject SQL metacharacters (e.g., single quotes, UNION operators, stacked queries) to manipulate query logic. Typical PHP/MySQL configurations enable multi-query execution and information_schema access, allowing attackers to enumerate database structure, extract credentials, modify records, or execute administrative commands depending on database user privileges.

RemediationAI

Primary mitigation requires replacing dynamic SQL concatenation in assignInstructorSubjects.php with parameterized queries using PHP PDO prepared statements or MySQLi bind_param functions. Specifically, the 'subjcode' parameter must be bound as a typed parameter rather than interpolated into query strings. No vendor-released patch identified at time of analysis. Organizations should implement immediate workarounds: apply web application firewall rules to block SQL metacharacters in the 'subjcode' parameter (though bypassable, provides defense-in-depth), restrict database user privileges to minimum required operations (preventing stacked queries or information_schema access), and disable the assignInstructorSubjects.php endpoint until code remediation is completed. For permanent fix, refactor code following OWASP SQL Injection Prevention guidelines at https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html. Monitor application logs for SQL error messages or unusual query patterns targeting this endpoint.