Is there a public PoC exploit available for CVE-2026-10258?

Yes, a public proof-of-concept exploit is available for CVE-2026-10258. Prioritise patching immediately. EPSS: 0.0%.

itsourcecode CMS CVE-2026-10258

Q: What is the CVSS score of CVE-2026-10258?

CVE-2026-10258 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33637 LOW

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-cqr5-3fqx-99xv

PHP SQLi Content Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 13:22 NVD

MEDIUM LOW

CVSS changed

Jun 01, 2026 - 13:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 01, 2026 - 13:16 vuln.today

DescriptionCVE.org

A weakness has been identified in itsourcecode Content Management System 1.0. Impacted is an unknown function of the file /admin/add_sub_topic.php. This manipulation of the argument topic_id causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in itsourcecode Content Management System 1.0 allows remote authenticated attackers to manipulate the backend database via the topic_id parameter in /admin/add_sub_topic.php. The CVSS vector (PR:L) confirms exploitation requires low-privilege authentication, limiting opportunistic attack surface but not eliminating risk in multi-tenant or shared-admin environments. Publicly available exploit code exists, elevating practical risk above what the moderate CVSS score of 6.3 alone suggests.

Technical ContextAI

The affected product is a PHP-based Content Management System developed by itsourcecode, identified by CPE cpe:2.3:a:itsourcecode:content_management_system:*:*:*:*:*:*:*:*. The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw: the topic_id argument passed to /admin/add_sub_topic.php is incorporated into a database query without adequate sanitization or parameterization, allowing an attacker to alter query logic. PHP applications of this category frequently use procedural MySQL or MySQLi calls without prepared statements, which is the root cause class here. The wildcard version in the CPE string suggests NVD has not bounded the affected range beyond what the vendor reported.

RemediationAI

No vendor-released patch has been identified at time of analysis; the itsourcecode.com vendor site does not publish a security advisory for this CVE. Until a patch is available, administrators should apply the following specific compensating controls: restrict access to the /admin/ directory to trusted IP ranges via web server configuration (e.g., Apache Allow/Deny directives or nginx allow/deny blocks), which prevents exploitation by network-level attackers even with valid credentials. Implement a Web Application Firewall (WAF) rule blocking SQL metacharacters (single quotes, UNION, SELECT, --, etc.) in the topic_id POST parameter - note this may cause false positives if legitimate topic IDs contain special characters. Enforce strong, unique credentials for all CMS admin accounts to raise the bar for the required PR:L authentication step. Developers should refactor /admin/add_sub_topic.php to use PDO or MySQLi prepared statements with bound parameters as the permanent fix. References: https://vuldb.com/vuln/367538, https://github.com/ltranquility/vuln_submit/issues/5.