CVE-2026-37345

SourceCodester Vehicle Parking Area Management System version 1.0 contains a critical SQL Injection vulnerability in the /parking/manage_park.php file that allows unauthenticated attackers to manipulate database queries. This vulnerability affects the parking management system and could enable unauthorized access to sensitive parking data and system functions. The vulnerability has been assigned a CVSS 3.1 score of 9.8 (CRITICAL) with a network-based attack vector requiring no authentication, low attack complexity, and no user interaction. Successful exploitation could result in complete compromise of confidentiality, integrity, and availability of the affected system, allowing attackers to read, modify, or delete database records. There is currently no evidence of active exploitation in the wild, as the vulnerability does not appear on CISA's Known Exploited Vulnerabilities list and remains inactive on security hotlists. However, the extremely low EPSS score suggests limited real-world exploitation activity despite the critical severity rating. Organizations running this application should prioritize patching or implementing access controls while monitoring for exploitation attempts.