Is there a public PoC exploit available for CVE-2026-10297?

Yes, a public proof-of-concept exploit is available for CVE-2026-10297. Prioritise patching immediately. EPSS: 0.0%.

Fees Management System CVE-2026-10297

Q: What is the CVSS score of CVE-2026-10297?

CVE-2026-10297 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33828 LOW

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-vmm4-jcj8-j9q2

PHP SQLi Fees Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

Jun 01, 2026 - 23:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 01, 2026 - 22:58 vuln.today

DescriptionCVE.org

A vulnerability was identified in itsourcecode Fees Management System 1.0. This affects an unknown part of the file /manage_course.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Fees Management System 1.0 exposes the /manage_course.php endpoint to database manipulation via an unsanitized ID parameter, reachable by any low-privileged authenticated user over the network. The CVSS 6.3 medium score reflects limited impact scope (C:L/I:L/A:L), but the availability of public proof-of-concept exploit code materially elevates operational risk for internet-facing deployments. No public exploit identified at time of analysis maps to CISA KEV; however, the E:P CVSS modifier confirms exploit code is circulating.

Technical ContextAI

The affected product is a PHP-based school administration web application (CPE: cpe:2.3:a:itsourcecode:fees_management_system:*:*:*:*:*:*:*:*) developed by itsourcecode. CWE-89 (Improper Neutralization of Special Elements used in SQL Command) identifies the root cause: the ID parameter submitted to /manage_course.php is interpolated directly into a backend SQL query without parameterization or escaping, enabling classic in-band or blind SQL injection. PHP applications of this class - typically built without ORM layers or prepared statements - are a well-documented source of CWE-89 findings. The wildcard in the CPE version field indicates NVD has not formally bounded the affected version range beyond the disclosed 1.0 release.

RemediationAI

No vendor-released patch has been identified at time of analysis; the RL:X CVSS remediation level modifier corroborates the absence of a known fix. As an immediate compensating control, restrict access to /manage_course.php at the web server or firewall layer to trusted IP ranges only, accepting the trade-off that this reduces but does not eliminate risk if attackers already hold credentials within allowed ranges. Deploying a web application firewall with SQL injection signatures targeting the ID parameter of /manage_course.php can detect and block common payload patterns, though WAF bypass techniques exist for motivated attackers. Organizations should strongly consider taking internet-facing instances of the Fees Management System offline or behind VPN until a patched version is released, given the public PoC availability. The exploit is documented at https://github.com/ltranquility/vuln_submit/issues/8 and the VulDB entry at https://vuldb.com/vuln/367590 - both should be reviewed when crafting WAF rules or evaluating exposure.