Is there a public PoC exploit available for CVE-2026-9527?

Yes, a public proof-of-concept exploit is available for CVE-2026-9527. Prioritise patching immediately. EPSS: 0.0%.

Electronic Judging System CVE-2026-9527

Q: What is the CVSS score of CVE-2026-9527?

CVE-2026-9527 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31787 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-26 VulDB

GHSA-cv39-99wf-hfgm

PHP XSS Electronic Judging System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:25 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 20:07 NVD

4.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was determined in itsourcecode Electronic Judging System 1.0. This issue affects some unknown processing of the file /admin/judges.php. This manipulation of the argument fname causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Reflected cross-site scripting in itsourcecode Electronic Judging System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the fname parameter of /admin/judges.php, executing arbitrary JavaScript in the context of a victim's browser session. The CVSS 4.0 score of 2.1 reflects the low integrity impact and mandatory user interaction, consistent with a reflected XSS that requires a victim to follow a crafted URL. No public exploit identified at time of analysis as KEV-listed, but a publicly available proof-of-concept exists on GitHub, slightly elevating practical risk despite the EPSS score of 0.03% (10th percentile).

Technical ContextAI

Electronic Judging System 1.0, developed by itsourcecode, is a PHP-based web application for managing competitive programming or academic judging workflows. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS), meaning user-supplied input to the fname argument is rendered back into the HTML response of /admin/judges.php without adequate output encoding or sanitization. The affected CPE string cpe:2.3:a:itsourcecode:electronic_judging_system:*:*:*:*:*:*:*:* covers all tracked versions, though only version 1.0 is specifically confirmed affected per the EUVD entry EUVD-2026-31787. The PHP tag indicates the server-side rendering path where the unsanitized input is echoed into the DOM.

RemediationAI

No vendor-released patch has been identified at time of analysis. The vendor site (https://itsourcecode.com/) has not published a security advisory. As a primary remediation, the application developer should apply context-aware HTML output encoding to the fname parameter before rendering it in /admin/judges.php, using functions such as PHP's htmlspecialchars() with ENT_QUOTES and UTF-8 charset. Additionally, implementing a Content Security Policy (CSP) response header with a restrictive script-src directive would reduce exploitability of any remaining XSS vectors, though incorrect CSP configuration can break application functionality and should be tested carefully. For operators who cannot patch immediately, restricting access to the /admin/ directory via IP allowlisting or VPN-only exposure removes the network-reachable attack surface entirely, which is the most effective compensating control given the low severity of this finding. The public proof-of-concept is available at https://github.com/i-QvQ-i/first-OvO/issues/1 and the VulDB advisory is at https://vuldb.com/vuln/365546.