Pet Grooming Management Software CVE-2026-10254

No special conditions are required - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations of SourceCodester Pet Grooming Management Software 1.0 with no user interaction needed. The only limiting factors are: (1) the target application must be internet- or network-accessible on a reachable host, (2) exploitation is bounded to low confidentiality impact (file and directory name disclosure, not arbitrary file read or code execution), and (3) the software is a niche, freely distributed PHP application with a limited global deployment footprint, which naturally constrains the pool of reachable targets.

The CVSS 3.1 base score of 5.3 (Medium) reflects a network-reachable, low-complexity, unauthenticated attack with only low confidentiality impact and no integrity or availability impact (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The temporal vector qualifiers E:P (proof-of-concept exploit exists), RL:X (remediation level not defined), and RC:R (report confidence reasonable) indicate that exploitation tooling is available but a patch has not been formally released. No EPSS score was provided in the input data; it cannot be independently stated here. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, meaning active exploitation in the wild has not been officially confirmed. Despite the moderate CVSS score, the combination of zero authentication requirements, publicly available POC, and no vendor patch creates genuine risk, particularly since the /admin/ directory disclosure can serve as reconnaissance for chained attacks. The primary limiting factor is the narrow confidentiality impact - this is an information disclosure vulnerability, not direct code execution.

An unauthenticated remote attacker sends an HTTP GET request to the target's /admin/ path and receives a directory listing or path disclosure response revealing internal file and directory names. A publicly available proof-of-concept on GitHub documents this technique. The attacker uses the exposed file names to identify configuration files, database connection scripts, or backup archives and subsequently crafts targeted requests to retrieve those sensitive resources for credential harvesting or further lateral movement.