Which versions of Online House Rental System are affected by CVE-2026-10251?

itsourcecode Online House Rental System 1.0 contains an unauthenticated SQL injection vulnerability in the login endpoint that allows attackers to directly manipulate the backend database without…

Is there a public PoC exploit available for CVE-2026-10251?

Yes, a public proof-of-concept exploit is available for CVE-2026-10251. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-10251?

Within 24 hours: Confirm whether the system is internet-accessible and catalog all sensitive customer data it stores or processes. Within 7 days: Deploy a Web Application Firewall to block SQL injection attempts on the login parameter; implement network access controls to restrict system access to authorized users only; and review database logs for exploitation attempts. Within 30 days: Develop and execute a plan to replace this system with a supported alternative or procure vendor security updates.

Online House Rental System CVE-2026-10251

Q: What is the CVSS score of CVE-2026-10251?

CVE-2026-10251 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33626 MEDIUM

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-x45x-jwqm-6m6q

PHP SQLi Online House Rental System Itsourcecode

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 13:22 NVD

HIGH MEDIUM

CVSS changed

Jun 01, 2026 - 13:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 13:15 vuln.today

DescriptionCVE.org

A weakness has been identified in itsourcecode Online House Rental System 1.0. The impacted element is an unknown function of the file /ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in itsourcecode Online House Rental System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter of the /ajax.php?action=login endpoint to inject arbitrary SQL. Publicly available exploit code exists (VulDB-referenced PoC on GitHub), increasing the practical risk despite the application's limited deployment footprint. No CISA KEV listing is present, so this represents publicly available exploit code without confirmed active exploitation.

Technical ContextAI

The affected software is a PHP-based web application (itsourcecode Online House Rental System) distributed as open-source sample/educational code via itsourcecode.com. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically in the login AJAX handler at /ajax.php?action=login, where the Username POST parameter is concatenated into a SQL query without parameterization or escaping. CPE cpe:2.3:a:itsourcecode:online_house_rental_system identifies the precise product, and the PHP/SQLi tags confirm a classic injection pattern typical of unhardened PHP/MySQL learning-project codebases.

RemediationAI

No vendor-released patch identified at time of analysis; the VulDB entry (https://vuldb.com/vuln/367529) and exploit reference (https://github.com/zhengdexu-bot/zhengdexu/issues/3) do not cite a fixed version from itsourcecode. Operators should immediately patch the /ajax.php?action=login handler to use parameterized queries (PDO prepared statements or mysqli_prepare with bound parameters) for the Username and Password inputs, validate/whitelist input characters, and add server-side rate limiting on login attempts. As compensating controls until source-level fixes are applied: place the application behind a WAF with SQLi signature enforcement on /ajax.php (trade-off: may break legitimate username characters such as apostrophes); restrict /ajax.php?action=login to internal networks via reverse-proxy ACLs (trade-off: blocks legitimate remote tenants); and run the backing MySQL account with least privilege so successful injection cannot read/write outside the application schema.