Is there a public PoC exploit available for CVE-2026-10256?

Yes, a public proof-of-concept exploit is available for CVE-2026-10256. Prioritise patching immediately. EPSS: 0.0%.

itsourcecode CMS CVE-2026-10256

Q: What is the CVSS score of CVE-2026-10256?

CVE-2026-10256 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33635 LOW

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-8h8g-732q-f255

PHP SQLi Content Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 13:22 NVD

MEDIUM LOW

CVSS changed

Jun 01, 2026 - 13:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 01, 2026 - 13:16 vuln.today

DescriptionCVE.org

A vulnerability was identified in itsourcecode Content Management System 1.0. This vulnerability affects unknown code of the file /save_comment.php. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Content Management System 1.0 exposes the database to read, modify, and partial denial-of-service via a crafted comment submission. The vulnerable endpoint /save_comment.php fails to sanitize the Name parameter before incorporating it into SQL queries, allowing an authenticated low-privilege attacker to manipulate database logic directly. A publicly available proof-of-concept exploit exists (GitHub issue linked in VulDB entry), elevating real-world risk despite the absence of a CISA KEV listing.

Technical ContextAI

The affected application is a PHP-based Content Management System distributed by itsourcecode (CPE: cpe:2.3:a:itsourcecode:content_management_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where user-supplied input in the Name argument of the comment-saving endpoint is concatenated directly into a SQL query without parameterization or adequate escaping. This classic unsanitized input pattern in PHP applications allows an attacker to break out of the intended query structure and append or union arbitrary SQL clauses, giving access to underlying database tables, credentials, and application data. The wildcard version in the CPE string suggests the vendor has not published version-bound boundaries, and the vulnerability may extend beyond the specifically reported 1.0 release.

RemediationAI

No vendor-released patch has been identified at time of analysis - the CVSS temporal remediation level is RL:X (unknown), and no fix version appears in the VulDB report or vendor site. Until a patch is available, operators should apply a web application firewall (WAF) rule to sanitize or block SQL metacharacters (single quotes, double dashes, UNION keywords) in the Name parameter on POST requests to /save_comment.php; note that WAF rules can be bypassed by advanced encoding and are not a substitute for code-level fixes. As a higher-confidence control, restrict access to /save_comment.php to authenticated sessions only via server-level access controls (e.g., .htaccess or nginx location blocks) and enforce strong password policies or registration approval workflows to raise the cost of obtaining a low-privilege account. Developers should remediate by replacing string-concatenated SQL queries with parameterized prepared statements using PHP PDO or MySQLi, which eliminates the injection surface entirely. Monitor database query logs for anomalous UNION, SELECT INTO, or stacked-query patterns as a detection measure.