Is there a public PoC exploit available for CVE-2026-10811?

Yes, a public proof-of-concept exploit is available for CVE-2026-10811. Prioritise patching immediately. EPSS: 0.0%.

Fees Management System CVE-2026-10811

Q: What is the CVSS score of CVE-2026-10811?

CVE-2026-10811 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34267 LOW

SQL Injection (CWE-89)

2026-06-04 VulDB

GHSA-6v8g-5v55-rqqq

PHP SQLi Fees Management System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 04, 2026 - 15:22 NVD

MEDIUM LOW

CVSS changed

Jun 04, 2026 - 15:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 04, 2026 - 14:54 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in itsourcecode Fees Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /receipt.php. Such manipulation of the argument ef_id leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in itsourcecode Fees Management System 1.0 exposes the /receipt.php endpoint to database manipulation by authenticated remote attackers via the ef_id parameter. The CVSS temporal metric E:P confirms a publicly available exploit, disclosed via a GitHub issue, meaning exploitation is accessible to low-skilled attackers. No CISA KEV listing is present, but the combination of public POC, network-reachable attack vector, and low attack complexity makes this a credible threat for any internet-facing deployment of this PHP application.

Technical ContextAI

Fees Management System 1.0 is a PHP-based web application distributed by itsourcecode (cpe:2.3:a:itsourcecode:fees_management_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that user-supplied input from the ef_id parameter in /receipt.php is concatenated directly into a SQL query without parameterization or adequate sanitization. This is a classic pattern in small, educational-grade PHP applications where PDO prepared statements or equivalent protections are absent. The affected CPE version wildcard (*) suggests no specific patched version has been identified, implying the entire 1.0 release line is vulnerable.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is to refactor /receipt.php to use parameterized queries or prepared statements (e.g., PHP PDO or MySQLi with bound parameters) for the ef_id input, which eliminates the injection vector at the root cause. As a compensating control, deploy a web application firewall (WAF) rule to detect and block SQL metacharacter sequences in the ef_id parameter - note that WAF-based mitigations can be bypassed by sufficiently obfuscated payloads and should not be treated as a permanent fix. Additionally, restrict access to the application to trusted network segments or VPN if it does not need to be internet-facing, reducing exposure to opportunistic attackers. Database user privileges for the application account should be scoped to the minimum required (no FILE, DROP, or GRANT privileges) to limit the impact of a successful injection. Monitor VulDB at https://vuldb.com/vuln/368259 and the itsourcecode vendor page for patch releases.