What is the CVSS score of EUVD-2026-23264?

EUVD-2026-23264 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

SourceCodester Payroll System EUVD-2026-23264

| CVE-2026-37346 MEDIUM

SQL Injection (CWE-89)

2026-04-16 cve@mitre.org

GHSA-3xhp-52jc-www8

PHP SQLi

4.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.7 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.7 MEDIUM

SQL injection permits full database read/write beyond app-layer controls, warranting C:H/I:H; availability impact is limited to data corruption, not service denial; PR:H reflects mandatory admin authentication.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:35 vuln.today

CVSS changed

Apr 16, 2026 - 16:22 NVD

4.7 (MEDIUM)

EUVD ID Assigned

Apr 16, 2026 - 15:22 euvd

EUVD-2026-23264

CVE Published

Apr 16, 2026 - 15:17 nvd

MEDIUM 4.7

DescriptionCVE.org

SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_account.php?emp_id=.

AnalysisAI

SQL Injection in SourceCodester Payroll Management and Information System v1.0 exposes the /payroll/view_account.php endpoint to database-level manipulation via the emp_id GET parameter. The CVSS vector (PR:H) confirms exploitation requires high-privilege (administrative) authentication, substantially narrowing the realistic attacker population. No public exploit code or active exploitation has been identified; EPSS places this at the 7th percentile (0.02%), and SSVC assessment concurs with exploitation status of none and non-automatable attack path.

Technical ContextAI

The application is a PHP-based payroll management system distributed by SourceCodester. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates that user-supplied input - specifically the emp_id query string parameter in view_account.php - is concatenated into a SQL query without parameterization or adequate sanitization. This classic unsanitized-input pattern allows an attacker to alter query logic, enumerate tables, extract credential or payroll records, and potentially write data. No CPE string was provided in the intelligence; the affected version is confirmed as v1.0 from the CVE description. The attack surface is a PHP web application served over HTTP/S, consistent with the AV:N (network) vector.

RemediationAI

No vendor-released patch has been identified at time of analysis for SourceCodester Payroll Management and Information System v1.0. The definitive fix is to refactor the SQL query in /payroll/view_account.php to use prepared statements with parameterized queries, eliminating direct interpolation of the emp_id value. As a compensating control, deploy a Web Application Firewall rule to detect and block common SQLi patterns in the emp_id parameter - note this adds operational overhead and may generate false positives on legitimate numeric IDs. Additionally, restrict administrative interface access to trusted IP ranges or VPN-only networks, reducing the exposed attack surface given that PR:H is already required. Audit all other PHP files in the application for similar unsanitized parameter usage, as SourceCodester projects frequently share the same unparameterized query pattern across endpoints. References: https://github.com/mt-0505/cve-report/blob/main/sourcecodester/payroll-management-and-information-system/SQL-1.md and https://nvd.nist.gov/vuln/detail/CVE-2026-37346.