itsourcecode CMS CVE-2026-10265

Q: What is the CVSS score of CVE-2026-10265?

CVE-2026-10265 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33647 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-01 cna@vuldb.com

GHSA-w98h-6qxg-qf6h

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 15:34 vuln.today

DescriptionCVE.org

A vulnerability was identified in itsourcecode Content Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/edit_topic.php. Such manipulation of the argument topic_id leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Content Management System 1.0 allows authenticated remote attackers to manipulate database queries via the topic_id parameter in /admin/edit_topic.php. The CVSS 4.0 vector (PR:L) confirms a low-privileged authenticated account is sufficient to trigger the injection, which yields limited but real confidentiality, integrity, and availability impact against the underlying database component. Publicly available exploit code exists (E:P), though no active exploitation has been confirmed by CISA KEV.

Technical ContextAI

The affected product is itsourcecode Content Management System version 1.0, a PHP-based CMS commonly used in academic or tutorial contexts. The vulnerability resides in the admin topic-editing endpoint (/admin/edit_topic.php), where the topic_id parameter is passed unsanitized to a backend SQL query. The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), the parent class of CWE-89 (SQL Injection), indicating a failure to sanitize or parameterize user-supplied input before constructing SQL statements. The PHP tag confirms the application stack. No ORM or prepared-statement layer appears to be in use for this endpoint.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is to replace string-concatenated SQL queries in /admin/edit_topic.php with parameterized queries or prepared statements using PHP's PDO or MySQLi extensions, eliminating the injection vector entirely. As a compensating control, restrict access to the /admin/ directory to trusted IP ranges via web server configuration (e.g., Apache .htaccess allow/deny or nginx geo-IP rules), which limits exposure to authenticated internal users only - note this does not fix the underlying flaw and does not protect against insider threats. Additionally, enforce the principle of least privilege on database accounts used by the CMS, so the SQL user cannot perform destructive operations (DROP, TRUNCATE) even if injection occurs. The researcher-submitted proof-of-concept is publicly accessible at https://github.com/Mr-Elymas/cve_submit/issues/2 and can be used to verify remediation effectiveness in a test environment.