Is there a public PoC exploit available for CVE-2026-10693?

Yes, a public proof-of-concept exploit is available for CVE-2026-10693. Prioritise patching immediately. EPSS: 0.0%.

Online Boat Reservation System CVE-2026-10693

Q: What is the CVSS score of CVE-2026-10693?

CVE-2026-10693 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34058 LOW

Improper Authorization (CWE-285)

2026-06-03 VulDB

GHSA-f493-gq25-5c5x

Authentication Bypass Online Boat Reservation System Sourcecodester

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 03, 2026 - 01:22 NVD

MEDIUM LOW

CVSS changed

Jun 03, 2026 - 01:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 03, 2026 - 00:44 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the component Administrative Endpoint. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Multiple endpoints are affected.

AnalysisAI

Improper authorization across multiple administrative endpoints in SourceCodester Online Boat Reservation System 1.0 allows remote authenticated attackers with low-privilege accounts to bypass access controls and interact with admin-only functionality. The vulnerability, classified as broken access control (CWE-285), enables unauthorized reads, writes, and limited availability impact on restricted resources. A publicly available proof-of-concept exploit has been disclosed on Medium, and no public exploit identified at time of analysis meets the CISA KEV threshold - however, the existence of a walkthrough PoC materially lowers the barrier to exploitation.

Technical ContextAI

CWE-285 (Improper Authorization) describes a failure in the application's access control enforcement layer - the system authenticates users but does not adequately verify whether a given authenticated user possesses the required role or privilege to execute operations on administrative endpoints. The affected product, identified by CPE cpe:2.3:a:sourcecodester:online_boat_reservation_system:*:*:*:*:*:*:*:*, is a PHP-based web reservation application distributed by SourceCodester, a platform known for distributing open-source academic and small-business web apps that frequently lack enterprise-grade security controls. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U indicates that the administrative endpoints are reachable over the network with no special environmental conditions, requiring only a low-privilege authenticated session - consistent with a scenario where regular user accounts can directly request admin URLs without server-side role verification. The tags 'Authentication Bypass' and the CWE together indicate that while authentication itself is present, authorization enforcement at the route or controller level is absent or trivially circumvented.

RemediationAI

No vendor-released patch has been identified at time of analysis - the CPE wildcard and absence of a fixed-version advisory indicate SourceCodester has not published a corrective release. As a primary compensating control, organizations should restrict direct access to all administrative endpoints using server-level access controls (e.g., IP allowlisting via .htaccess or web server configuration), accepting the trade-off of reduced administrative flexibility for external users. Additionally, role-based access control should be manually patched into the application's PHP controller layer by verifying session role on every admin route before processing the request - this is a code-level fix with no service-disruption side effects. Deployers should also consider placing the administrative panel behind a VPN or internal-only network segment. Reference the public PoC at https://medium.com/@hemantrajbhati5555/broken-access-control-in-sourcecodester-online-boat-reservation-system-1-0-4ed0380d2222 to identify the specific endpoints disclosed and prioritize their protection. Monitor VulDB (https://vuldb.com/vuln/367962) for any future patch release from the vendor.