Cyber Resilience

CVE-2026-36948

High

Published: 13 April 2026

Published
13 April 2026
Modified
17 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0004 11.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-36948 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-36948 is a SQL injection vulnerability (CWE-89) affecting Sourcecodester Online Thesis Archiving System version 1.0, specifically in the file /otas/view_archive.php. The issue has a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility, low complexity, and lack of required privileges or user interaction.

Remote, unauthenticated attackers can exploit this vulnerability over the network with low effort to inject malicious SQL payloads. Successful exploitation enables limited impacts, including low-level disclosure of sensitive data, minor modifications to database integrity, and restricted denial of service through low availability disruption.

The primary advisory reference is a GitHub bug report at https://github.com/huliangjia/bug_report/blob/main/Sourcecodester/online-thesis-archiving-system/SQL-1.md, which details the vulnerability but does not specify patches or mitigations in the provided information. Security practitioners should review the source code for input sanitization and apply updates if available from the vendor.

EU & UK References

Vulnerability details

Sourcecodester Online Thesis Archiving System v1.0 is vulnerale to SQL injection in the file /otas/view_archive.php.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in a publicly accessible web application directly enables exploitation of public-facing applications (T1190) for remote unauthenticated access, data disclosure, and limited manipulation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89
CVE-2025-22699Shared CWE-89
CVE-2026-36232Shared CWE-89
CVE-2026-31871Shared CWE-89
CVE-2026-33078Shared CWE-89
CVE-2026-46359Shared CWE-89
CVE-2025-22691Shared CWE-89

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

SI-10 requires validation of all inputs to ensure consistency with expected formats, directly preventing SQL injection by rejecting malicious payloads in /otas/view_archive.php.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates identification, prioritization, and remediation of system flaws like this SQL injection vulnerability through patching the affected PHP file.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

RA-5 vulnerability scanning and monitoring identifies SQL injection flaws such as CVE-2026-36948 in web applications prior to exploitation.

References