Is there a public PoC exploit available for CVE-2026-10257?

Yes, a public proof-of-concept exploit is available for CVE-2026-10257. Prioritise patching immediately. EPSS: 0.0%.

itsourcecode CMS CVE-2026-10257

Q: What is the CVSS score of CVE-2026-10257?

CVE-2026-10257 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33636 LOW

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-gv7h-6xr5-p7mj

PHP SQLi Content Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 13:22 NVD

MEDIUM LOW

CVSS changed

Jun 01, 2026 - 13:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 01, 2026 - 13:16 vuln.today

DescriptionCVE.org

A security flaw has been discovered in itsourcecode Content Management System 1.0. This issue affects some unknown processing of the file /admin/update_ss_img.php. The manipulation of the argument topic_id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in itsourcecode Content Management System 1.0 exposes the admin-facing endpoint /admin/update_ss_img.php to database manipulation via the unsanitized topic_id parameter. Low-privilege authenticated attackers can exploit this remotely with no user interaction required, achieving partial read, write, and availability impact against the underlying database. A public exploit is available (CVSS temporal E:P; GitHub PoC linked in references), elevating practical risk despite the moderate 6.3 base score. No active exploitation confirmed via CISA KEV at time of analysis.

Technical ContextAI

The affected application is a PHP-based Content Management System developed by itsourcecode (CPE: cpe:2.3:a:itsourcecode:content_management_system:*:*:*:*:*:*:*:*). The vulnerable file /admin/update_ss_img.php processes an HTTP parameter named topic_id without adequate sanitization or parameterization before incorporating it into a SQL query, constituting a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw. This class of vulnerability arises when user-controlled input is interpolated directly into SQL statement strings rather than passed through prepared statements or ORM-level query binding. The admin endpoint context implies the application's database layer handles content and possibly credential data, widening the potential blast radius of successful injection.

RemediationAI

No vendor-released patch has been identified at time of analysis (CVSS temporal RL:X confirms no official remediation is defined). Developers should immediately remediate the root cause by replacing direct string interpolation of the topic_id parameter in /admin/update_ss_img.php with parameterized queries or prepared statements using PDO or MySQLi with bound parameters - this eliminates the injection surface without application-level side effects. As a compensating control, deploy a Web Application Firewall (WAF) rule to detect and block SQL metacharacter sequences in the topic_id parameter, though WAF bypass techniques exist and this is not a substitute for code-level remediation. Access to the /admin/ directory should be restricted by IP allowlist at the web server or network perimeter layer where operationally feasible, reducing exposure to authenticated low-privilege accounts by limiting who can reach the endpoint at all. Monitor VulDB (https://vuldb.com/cve/CVE-2026-10257) and the itsourcecode vendor site for patch releases.