EUVD-2026-34856
GHSA-34gp-5c7w-p6jr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System 1.0. Impacted is an unknown function of the file /admin/?page=user/manage_user. The manipulation of the argument Username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
AnalysisAI
Stored cross-site scripting in SourceCodester Ship Ferry Ticket Reservation System 1.0 allows a remote attacker with high-privilege (admin-level) access to inject persistent malicious JavaScript into the Username field of the user management panel at /admin/?page=user/manage_user, which then executes in the browser of any other privileged user who visits that page. The vulnerability carries a CVSS base score of only 2.4 due to the combination of required high privileges, mandatory user interaction, and limited integrity-only impact with no confidentiality or availability consequence. No public exploit identified at time of analysis as a KEV-confirmed threat, but publicly available exploit code exists via a published Medium article and VulDB report.
Technical ContextAI
The affected component is the admin-side user management interface of SourceCodester Ship Ferry Ticket Reservation System 1.0, identified by CPE cpe:2.3:a:sourcecodester:ship_ferry_ticket_reservation_system:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored (persistent) variant. The Username parameter submitted to /admin/?page=user/manage_user is written to the backend datastore without adequate output encoding or input sanitization. When the stored value is later rendered in the admin user list view, the browser interprets injected content as executable JavaScript rather than display text. This is a classic server-side stored XSS pattern where the injection point and the execution point are separated in time and potentially in user session.
RemediationAI
No vendor-released patch identified at time of analysis. The SourceCodester vendor site (https://www.sourcecodester.com/) does not appear to have published a security advisory or patched release for this CVE. As a compensating control, administrators should apply server-side output encoding to all user-supplied fields rendered in admin views - specifically the Username field in the user management page - using context-appropriate encoding (HTML entity encoding for HTML contexts). Input validation should reject or strip HTML/script tags from username inputs at the point of data entry. Deploying a Web Application Firewall (WAF) with XSS detection rules can reduce exploitation likelihood but is not a substitute for fixing the root cause and may introduce false positives on legitimate admin inputs. Restricting admin panel access to trusted IP ranges via network-layer controls limits the attack surface to authenticated sessions from known locations. The trade-off of IP restriction is reduced administrative flexibility for remote access scenarios.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today