Is there a public PoC exploit available for CVE-2026-10808?

Yes, a public proof-of-concept exploit is available for CVE-2026-10808. Prioritise patching immediately. EPSS: 0.0%.

Fees Management System CVE-2026-10808

Q: What is the CVSS score of CVE-2026-10808?

CVE-2026-10808 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34254 LOW

SQL Injection (CWE-89)

2026-06-04 VulDB

GHSA-qcp4-xcgp-8f3v

PHP SQLi Fees Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 04, 2026 - 14:22 NVD

MEDIUM LOW

CVSS changed

Jun 04, 2026 - 14:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 04, 2026 - 14:19 vuln.today

DescriptionCVE.org

A vulnerability was identified in itsourcecode Fees Management System 1.0. This affects an unknown function of the file /manage_student.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Fees Management System 1.0 allows low-privileged remote attackers to manipulate database queries via the ID parameter in /manage_student.php, resulting in partial compromise of confidentiality, integrity, and availability. The affected product is a PHP-based academic fee tracking application; exploitation requires a valid low-privilege account but no additional user interaction. A publicly available proof-of-concept exploit (referenced via GitHub) lowers the bar for opportunistic exploitation, though no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.

Technical ContextAI

The affected product is a PHP web application developed by itsourcecode, identified by CPE cpe:2.3:a:itsourcecode:fees_management_system:*:*:*:*:*:*:*:*. The vulnerability class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input passed to the ID parameter in the /manage_student.php script is concatenated directly into a SQL query without adequate sanitization or parameterization. This is a classic and well-understood PHP SQLi pattern, commonly found in low-budget or student-project-grade PHP applications that rely on procedural database calls (e.g., mysql_query or unparameterized PDO) rather than prepared statements. The CVSS vector AV:N/AC:L confirms the injection is reachable over the network with no special conditions, while PR:L indicates the endpoint is behind at least a basic authentication gate.

RemediationAI

No vendor-released patch has been identified at time of analysis - the CPE wildcard and absence of a fix advisory in the provided references indicate the vendor has not published a remediation. Developers with access to the source code should immediately replace any dynamic SQL string construction in /manage_student.php that interpolates the ID parameter with PDO or MySQLi prepared statements using bound parameters; this eliminates the injection root cause entirely. As a compensating control, deploying a Web Application Firewall (WAF) rule to detect and block SQL metacharacters (e.g., single quotes, UNION, SELECT keywords) in the ID parameter can reduce exploitation risk with the trade-off of potential false positives on legitimate numeric IDs. Access to the /manage_student.php endpoint should be restricted to the minimum required network segment (e.g., internal LAN only), reducing external attack surface. Input-side validation enforcing that the ID parameter accepts only numeric values is a low-effort additional layer but should not be treated as a substitute for parameterized queries. References: VulDB entry at https://vuldb.com/vuln/368256 and PoC at https://github.com/ltranquility/vuln_submit/issues/12.