Skip to main content

Pet Grooming Management Software CVE-2026-10254

| EUVD-2026-33633 MEDIUM
Insertion of Sensitive Information into Externally-Accessible File (CWE-538)
2026-06-01 VulDB GHSA-fv4h-8p5m-3cg2
Information Disclosure Pet Grooming Management Software
5.5
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
CVSS changed
Jun 01, 2026 - 13:22 NVD
5.3 (MEDIUM) 5.5 (MEDIUM)
Analysis Generated
Jun 01, 2026 - 13:17 vuln.today

DescriptionCVE.org

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/. This manipulation causes file and directory information exposure. The attack can be initiated remotely. The exploit has been published and may be used.

AnalysisAI

File and directory information exposure in SourceCodester Pet Grooming Management Software 1.0 allows remote unauthenticated attackers to enumerate internal file and directory structures via the /admin/ endpoint. The root cause is CWE-538 (Deployment of Code to Unauthorized Actors / File and Directory Information Exposure), and a proof-of-concept exploit has been publicly released on GitHub. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify exposed Pet Grooming app instance
Delivery
Send unauthenticated GET to /admin/ path
Exploit
Trigger file and directory listing disclosure
Execution
Enumerate sensitive file names (configs, backups)
Impact
Target follow-on requests to extract credentials or sensitive data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions are required - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations of SourceCodester Pet Grooming Management Software 1.0 with no user interaction needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 5.3 (Medium) reflects a network-reachable, low-complexity, unauthenticated attack with only low confidentiality impact and no integrity or availability impact (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated remote attacker sends an HTTP GET request to the target's /admin/ path and receives a directory listing or path disclosure response revealing internal file and directory names. A publicly available proof-of-concept on GitHub documents this technique. …
Remediation No vendor-released patch has been identified at time of analysis; the remediation level in the CVSS temporal vector is marked RL:X (not defined), and no fix version appears in any of the provided references. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-10254 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy