Is there a public PoC exploit available for CVE-2026-10568?

Yes, a public proof-of-concept exploit is available for CVE-2026-10568. Prioritise patching immediately. EPSS: 0.0%.

Fees Management System CVE-2026-10568

Q: What is the CVSS score of CVE-2026-10568?

CVE-2026-10568 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33877 LOW

SQL Injection (CWE-89)

2026-06-02 VulDB

GHSA-6r4w-6224-7jw7

PHP SQLi Fees Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 02, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Jun 02, 2026 - 03:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 02, 2026 - 02:46 vuln.today

DescriptionCVE.org

A vulnerability was detected in itsourcecode Fees Management System 1.0. Affected is an unknown function of the file /manage_payment.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in itsourcecode Fees Management System 1.0 exposes database contents and integrity to authenticated low-privilege remote attackers via the unsanitized ID parameter in /manage_payment.php. The CVSS vector (PR:L) confirms exploitation requires a valid user account, but no elevated privileges are needed beyond basic authentication. A publicly available proof-of-concept exploit exists (GitHub), raising the practical exploitation risk; no vendor-released patch has been identified at time of analysis.

Technical ContextAI

The affected application is a PHP-based school fees management system distributed by itsourcecode (CPE: cpe:2.3:a:itsourcecode:fees_management_system:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection condition where the ID parameter passed to /manage_payment.php is incorporated directly into a database query without parameterization or adequate sanitization. This allows an attacker to alter the intended SQL logic, potentially enumerating tables, extracting credentials or PII, modifying payment records, or causing denial of service against the database layer. The CVSS temporal modifier E:P confirms that proof-of-concept exploit code is available, and RC:R indicates reasonable (though not fully confirmed) confidence in the vulnerability.

RemediationAI

No vendor-released patch has been identified at time of analysis - the remediation level in the CVSS temporal vector is marked RL:X (not defined), and no fix version appears in any referenced advisory. The primary recommended fix is to apply parameterized queries (prepared statements) to all user-supplied input, particularly the ID parameter in /manage_payment.php, which eliminates the SQL injection root cause. As a compensating control, deploying a Web Application Firewall (WAF) with SQL injection rule sets can help detect and block exploitation attempts, though WAFs can be bypassed and are not a substitute for code-level fixes. Additionally, restricting access to /manage_payment.php to only trusted authenticated roles (e.g., administrators), enforcing principle of least privilege on the database account used by the application, and enabling database query logging to detect anomalous payloads are actionable mitigations. Monitoring for unusual SQL errors or unexpected data access patterns in logs provides detection coverage. Refer to the VulDB entry at https://vuldb.com/vuln/367675 and the PoC at https://github.com/ltranquility/vuln_submit/issues/11 for technical detail to aid in reproducing and validating any fix.