EUVD-2026-21338
GHSA-wvcm-8qcx-6vf4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A flaw has been found in code-projects Vehicle Showroom Management System 1.0. Impacted is an unknown function of the file /BranchManagement/ProfitAndLossReport.php. Executing a manipulation of the argument BRANCH_ID can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used.
AnalysisAI
Reflected cross-site scripting (XSS) in code-projects Vehicle Showroom Management System 1.0 allows remote unauthenticated attackers to inject malicious scripts via the BRANCH_ID parameter in /BranchManagement/ProfitAndLossReport.php, requiring user interaction to execute. Publicly available exploit code exists for this vulnerability, and while the CVSS score of 5.3 is moderate, the low integrity impact combined with user interaction requirement limits practical risk, though XSS vulnerabilities remain routinely exploitable in real-world scenarios.
Technical ContextAI
This vulnerability stems from improper input validation and output encoding in a PHP-based web application (CWE-79: Improper Neutralization of Input During Web Page Generation). The Vehicle Showroom Management System processes the BRANCH_ID parameter without sanitizing or encoding user-supplied input before rendering it in web page responses. The vulnerable file /BranchManagement/ProfitAndLossReport.php directly incorporates the BRANCH_ID argument into HTML output without using context-appropriate encoding functions (such as htmlspecialchars, urlencode, or framework-provided XSS protection mechanisms). Attackers can craft URLs containing JavaScript payloads that execute in victims' browsers when they visit the malicious link, allowing session hijacking, credential theft, or malware injection. The CVSS v4.0 vector indicates network-based attack vector with low complexity and no privilege requirements, but requires user interaction (UI:P) to trigger the payload.
RemediationAI
Immediate remediation requires upgrading to a patched version of the Vehicle Showroom Management System if available from code-projects.org; however, no specific fixed version has been independently confirmed in the provided data. As an interim workaround, implement server-side input validation and output encoding on the BRANCH_ID parameter by using PHP htmlspecialchars() or similar functions to encode special characters before rendering in HTML context, apply a Web Application Firewall (WAF) rule to block requests containing suspicious script tags or JavaScript protocols in the BRANCH_ID parameter, and restrict access to the /BranchManagement/ directory to authenticated users only. Organizations should contact code-projects directly via https://code-projects.org/ for patch availability and timeline. Given public exploit availability, patching should be prioritized within your standard vulnerability remediation SLA.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today