What is the CVSS score of CVE-2026-30522?

CVE-2026-30522 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-30522?

Yes, a public proof-of-concept exploit is available for CVE-2026-30522. Prioritise patching immediately. EPSS: 0.0%.

Loan Management System CVE-2026-30522

EUVD-2026-17895 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-04-01 cve@mitre.org

Authentication Bypass Loan Management System

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

PoC Detected

Apr 01, 2026 - 18:44 vuln.today

Public exploit code

EUVD ID Assigned

Apr 01, 2026 - 14:22 euvd

EUVD-2026-17895

Analysis Generated

Apr 01, 2026 - 14:22 vuln.today

CVE Published

Apr 01, 2026 - 14:16 nvd

MEDIUM 6.5

DescriptionCVE.org

A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application allows administrators to create "Loan Plans" with specific penalty rates for overdue payments. While the frontend interface prevents users from entering negative numbers in the "Monthly Overdue Penalty" field, this constraint is not enforced on the backend. An authenticated attacker can bypass the client-side restriction by manipulating the HTTP POST request to submit a negative value for the penalty_rate.

AnalysisAI

SourceCodester Loan Management System v1.0 allows authenticated administrators to submit negative penalty rates for loan overdue payments by bypassing client-side validation through direct HTTP POST manipulation, enabling financial fraud through reversed penalty calculations that benefit borrowers instead of lenders. The vulnerability requires authenticated access but no CVSS score, EPSS probability, or formal patch status is available; however, publicly available exploit code confirms the vulnerability's technical feasibility.

Technical ContextAI

The vulnerability stems from inadequate server-side input validation in the loan plan creation functionality. The application implements frontend JavaScript constraints that reject negative values in the 'Monthly Overdue Penalty' field, but these client-side controls are not mirrored by corresponding backend validation logic. An authenticated attacker can intercept the HTTP POST request containing the penalty_rate parameter and modify it to contain a negative number before it reaches the server. The server accepts this negative value and stores it in the database, causing the loan penalty calculation logic to invert the intended behavior-instead of charging borrowers additional fees for overdue payments, the system credits borrowers or reduces their principal, depending on how the penalty is applied in downstream calculations. This is a business logic flaw rather than a memory corruption or authentication bypass vulnerability, though it may be tagged as such due to the nature of its impact on authorization controls over financial transactions.

RemediationAI

The primary remediation is to implement server-side validation of the penalty_rate parameter that rejects any negative or zero values before the loan plan is created or updated. This validation must occur on the backend, independent of frontend constraints. Verify that all financial input fields (penalty rates, interest rates, fees) are validated to ensure they fall within acceptable positive ranges before being persisted to the database. Additionally, implement role-based access controls to restrict loan plan creation to only authorized administrators, and audit existing loan plans in the database to identify any with negative penalty rates that may indicate prior exploitation. Contact SourceCodester directly at the vendor's official security contact for availability of a patched version; consult the GitHub PoC at https://github.com/meifukun/Web-Security-PoCs/blob/main/Loan-Management-System/BusinessLogic-LoanPlan-NegativePenalty.md for technical details of the bypass mechanism. No vendor-released patch is independently confirmed from available data.