CVE-2026-36923

BRIEFING NOTE: CVE-2026-36923 Sourcecodester Cab Management System version 1.0 contains a SQL Injection vulnerability in the /cms/admin/bookings/view_booking.php file that allows authenticated attackers to execute arbitrary SQL queries. This vulnerability affects the administrative interface of the cab management application. The vulnerability carries a CVSS severity rating of 2.7 (LOW) with a network-based attack vector requiring high-level privileges and no user interaction. The impact is limited to low-level confidentiality disclosure, with no integrity or availability concerns. The EPSS score of 0.00026 indicates minimal real-world exploitation probability relative to other known vulnerabilities. Currently, there is no evidence of active exploitation, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is readily available, and community attention remains low. Organizations running this software should prioritize patching efforts toward higher-severity vulnerabilities but should still apply updates when available as a standard security practice.