Is there a public PoC exploit available for CVE-2026-10296?

Yes, a public proof-of-concept exploit is available for CVE-2026-10296. Prioritise patching immediately. EPSS: 0.0%.

Fees Management System CVE-2026-10296

Q: What is the CVSS score of CVE-2026-10296?

CVE-2026-10296 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33841 LOW

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-4wxj-v45f-gf8f

PHP SQLi Fees Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

Jun 01, 2026 - 23:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 01, 2026 - 22:59 vuln.today

DescriptionCVE.org

A vulnerability was determined in itsourcecode Fees Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in itsourcecode Fees Management System 1.0 exposes the /ajax.php endpoint to database manipulation via the Username parameter, allowing authenticated remote attackers with low-privilege credentials to read, modify, or corrupt application data. The CVSS vector (AV:N/AC:L/PR:L) confirms this is network-exploitable at low complexity with a low-privilege account requirement. A publicly available proof-of-concept exploit exists (confirmed by CVSS temporal modifier E:P and a GitHub disclosure), though no active exploitation has been confirmed by CISA KEV at the time of analysis.

Technical ContextAI

The affected application is a PHP-based web application (itsourcecode Fees Management System 1.0) identified by CPE cpe:2.3:a:itsourcecode:fees_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the Username parameter submitted to /ajax.php is incorporated into a backend SQL query without adequate sanitization or parameterization. This class of vulnerability allows an attacker to alter the logical structure of the SQL query, enabling data exfiltration (SELECT-based injection), data manipulation (INSERT/UPDATE/DELETE), or in some database configurations, operating-system-level interaction. PHP applications that rely on direct string concatenation for query construction rather than prepared statements are the canonical setting for CWE-89.

RemediationAI

No vendor-released patch identified at time of analysis - the CVSS temporal remediation level is undefined (RL:X) and no vendor advisory was found at https://itsourcecode.com/. Developers with access to the source should immediately replace string-concatenated SQL queries in /ajax.php with PHP PDO or MySQLi prepared statements and parameterized queries, which eliminates the injection surface entirely. As an interim compensating control, deployers should restrict access to /ajax.php using web server ACLs (e.g., Apache .htaccess or nginx allow/deny directives) to only trusted IP ranges, accepting the trade-off of reduced application functionality for external users. A Web Application Firewall (WAF) rule targeting SQLi patterns in the Username POST/GET parameter can reduce opportunistic exploitation but should not be treated as a sufficient standalone control, as bypass techniques exist. Monitor VulDB tracking at https://vuldb.com/vuln/367589 and the vendor site for patch releases.