Fees Management System CVE-2026-10302

Q: What is the CVSS score of CVE-2026-10302?

CVE-2026-10302 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33852 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-02 cna@vuldb.com

GHSA-4qqg-wwj3-fxwq

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 00:34 vuln.today

DescriptionCVE.org

A flaw has been found in itsourcecode Fees Management System 1.0. The impacted element is an unknown function of the file /manage_fee.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in itsourcecode Fees Management System 1.0 exposes authenticated low-privileged users a pathway to manipulate database content via the id parameter in /manage_fee.php. The vulnerability allows remote attackers with valid application credentials to read, modify, or partially disrupt database records. Publicly available exploit code exists (CVSS 4.0 E:P modifier confirmed), though no active exploitation has been confirmed by CISA KEV. The overall severity is low (CVSS 4.0: 2.1), reflecting limited scope and confidentiality impact.

Technical ContextAI

The affected application is a PHP-based fee management system distributed by itsourcecode.com, a platform primarily offering educational and demo source code. The vulnerability resides in /manage_fee.php, where the id request parameter is passed into a backend SQL query without sanitization or parameterization. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection) covers this root cause class, which encompasses SQL injection as a subtype. The absence of prepared statements or input validation in the PHP data layer allows attacker-controlled SQL fragments to alter query logic. No CPE string was provided in the available intelligence, and the application does not appear to be widely packaged or distributed via standard software repositories.

RemediationAI

No vendor-released patch has been identified at time of analysis. Because itsourcecode.com distributes educational demonstration code rather than maintained enterprise software, an official patch may not be forthcoming. Developers running this codebase should immediately replace direct SQL string concatenation in /manage_fee.php with PHP PDO or MySQLi prepared statements and parameterized queries for the id parameter - this eliminates the injection vector entirely. As a compensating control, deploying a Web Application Firewall (WAF) with SQL injection rulesets (such as OWASP ModSecurity Core Rule Set) can filter malicious payloads at the perimeter, though WAF bypass is possible by sophisticated attackers. Additionally, restrict the database account used by the application to the minimum required privileges (SELECT/INSERT/UPDATE only on specific tables), which limits data exposure if injection does occur. For advisory references, see https://vuldb.com/vuln/367595 and the researcher submission at https://github.com/ltranquility/vuln_submit/issues/10.