Is there a public PoC exploit available for CVE-2026-10809?

Yes, a public proof-of-concept exploit is available for CVE-2026-10809. Prioritise patching immediately. EPSS: 0.0%.

Fees Management System CVE-2026-10809

Q: What is the CVSS score of CVE-2026-10809?

CVE-2026-10809 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34258 LOW

SQL Injection (CWE-89)

2026-06-04 VulDB

GHSA-jhfx-cfhr-rg78

PHP SQLi Fees Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 04, 2026 - 14:22 NVD

MEDIUM LOW

CVSS changed

Jun 04, 2026 - 14:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 04, 2026 - 14:17 vuln.today

DescriptionCVE.org

A security flaw has been discovered in itsourcecode Fees Management System 1.0. This impacts an unknown function of the file /manage_user.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in itsourcecode Fees Management System 1.0 allows authenticated remote attackers with low privileges to manipulate database queries via the ID parameter in /manage_user.php. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation requiring only a low-privilege account, with confidentiality, integrity, and availability all partially impacted. A public proof-of-concept exploit is available (E:P in CVSS temporal metrics, corroborated by a GitHub issue), though no active exploitation has been confirmed via CISA KEV. No vendor-released patch has been identified at time of analysis.

Technical ContextAI

The affected application is a PHP-based web application - itsourcecode Fees Management System - used for managing student or institutional fee records. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input to the ID parameter in /manage_user.php is passed directly into a backend SQL query without adequate sanitization or parameterization. This is a classic unsanitized GET/POST parameter SQL injection pattern common in PHP applications that construct queries via string concatenation. The CPE string cpe:2.3:a:itsourcecode:fees_management_system:*:*:*:*:*:*:*:* uses a wildcard for the version field, suggesting NVD has not pinned an exact fixed version boundary and the scope of affected versions may be broader than just 1.0.

RemediationAI

No vendor-released patch has been identified at time of analysis; the remediation level is listed as unknown (RL:X) in the CVSS temporal vector. As an immediate compensating control, restrict access to /manage_user.php to only trusted, internal IP ranges using web server ACLs or a WAF rule - this limits the AV:N attack vector at the network layer. Deploy a WAF rule blocking common SQL injection payloads (e.g., OWASP CRS SQLi ruleset) on the affected endpoint, though WAF bypass is possible and this is not a permanent fix. If source code is accessible, the definitive fix is to replace string-concatenated SQL queries in manage_user.php with parameterized prepared statements (PDO or MySQLi with bound parameters in PHP). Review all other parameterized inputs across the application for similar patterns, as CWE-89 is frequently systemic in PHP applications of this type. Track the VulDB advisory at https://vuldb.com/vuln/368257 for patch availability updates.