Barangay Management System CVE-2026-11515

Q: What is the CVSS score of CVE-2026-11515?

CVE-2026-11515 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35057 MEDIUM

Use of Hard-coded Password (CWE-259)

2026-06-08 VulDB

GHSA-5jgp-863g-wff4

PHP Authentication Bypass

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:50 vuln.today

CVSS changed

Jun 08, 2026 - 13:22 NVD

5.3 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability has been found in SourceCodester Barangay Resident Profiling and Information Management System 1.0. The impacted element is an unknown function of the file passsword_reset.php of the component Password Reset Handler. Such manipulation of the argument new_password with the input password123 leads to use of hard-coded password. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Unauthenticated password reset bypass in SourceCodester Barangay Resident Profiling and Information Management System 1.0 allows remote attackers to reset user accounts to a known hard-coded credential via the passsword_reset.php endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and the E:P modifier confirms publicly available exploit code exists. Despite the VI:L integrity-only CVSS impact rating, the Authentication Bypass tag indicates the realistic consequence is full account takeover for any user whose password can be reset to the predictable hard-coded value 'password123'.

Technical ContextAI

The application is a PHP-based municipal government information system (CPE: cpe:2.3:a:sourcecodester:barangay_resident_profiling_and_information_management_system:*:*:*:*:*:*:*:*) developed by SourceCodester. The vulnerable component is passsword_reset.php, the password reset handler, which accepts the new_password parameter but applies or defaults to a hard-coded credential ('password123') rather than generating a cryptographically random reset token. This is classified as CWE-259 (Use of Hard-coded Password), a design-level flaw where a static secret is embedded in source code, making it trivially discoverable by any party with access to the disclosed exploit or source file. Because the reset handler is web-accessible and requires no prior session or token, the hard-coded value effectively functions as a universal skeleton key for the reset flow.

RemediationAI

No vendor-released patch has been identified at the time of analysis - no fix version or patched release appears in any referenced advisory. The primary remediation is to remove the hard-coded credential from passsword_reset.php and replace the password reset mechanism with a cryptographically random, single-use, time-limited token sent to the user's registered contact (email or SMS). As an immediate compensating control, administrators should restrict web server access to passsword_reset.php via IP allowlist or HTTP authentication at the server layer (e.g., Apache .htaccess or nginx auth_basic) - note this trades usability for security and may disrupt legitimate self-service resets. If the application is internet-facing, placing it behind a VPN or private network boundary until a code-level fix is applied is the most effective interim control. The VulDB disclosure is available at https://vuldb.com/vuln/369135 and CVE detail at https://vuldb.com/cve/CVE-2026-11515.