Fees Management System CVE-2026-10301

Q: What is the CVSS score of CVE-2026-10301?

CVE-2026-10301 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33849 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-02 cna@vuldb.com

GHSA-j8x4-4v59-r43j

XSS PHP

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 00:33 vuln.today

DescriptionCVE.org

A vulnerability was detected in itsourcecode Fees Management System 1.0. The affected element is an unknown function of the file index.php. Performing a manipulation of the argument page results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used.

AnalysisAI

Reflected cross-site scripting in itsourcecode Fees Management System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by manipulating the page argument of index.php. The vulnerability requires passive user interaction - a victim must follow a crafted URL - limiting its scalability, but publicly available exploit code lowers the barrier to abuse. No KEV listing exists; this is a low-severity finding corroborated by a CVSS 4.0 score of 2.1 and an exploit-modified (E:P) supplemental metric.

Technical ContextAI

The affected application is a PHP-based academic fees management system distributed by itsourcecode (https://itsourcecode.com/). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting): the page GET/POST parameter in index.php is reflected into the HTML response without adequate sanitization or output encoding. This is a classic reflected XSS pattern where user-supplied input travels from the HTTP request directly into the rendered DOM. The CVSS 4.0 vector confirms network delivery (AV:N), no special attack requirements (AT:N), and no authentication prerequisite (PR:N), consistent with a URL-based injection point in a PHP script. Scope is constrained to the vulnerable system only (SC:N/SI:N/SA:N), indicating the payload does not propagate to downstream systems.

RemediationAI

No vendor-released patch has been identified at time of analysis - no official advisory from itsourcecode was referenced and no fixed version is cited in the VulDB submission or GitHub issue (https://github.com/ltranquility/vuln_submit/issues/9). The primary recommended fix is to apply server-side output encoding to the page parameter before it is rendered in HTML context (e.g., PHP's htmlspecialchars() with ENT_QUOTES). As a compensating control, deploying a Content Security Policy (CSP) header that disallows inline scripts (script-src 'self') will prevent injected payloads from executing, though this may break any legitimate inline JavaScript in the application. Input validation rejecting non-alphanumeric characters from the page parameter is a secondary control that reduces attack surface with minimal application impact. Until a patch is available, administrators should consider placing the application behind an authenticated reverse proxy or WAF rule targeting reflected parameter injection patterns.