Which versions of Courier Management System are affected by CVE-2026-9606?

itsourcecode Courier Management System 1.0 contains an unauthenticated SQL injection vulnerability in the user management interface that enables remote attackers to directly manipulate backend…

Is there a public PoC exploit available for CVE-2026-9606?

Yes, a public proof-of-concept exploit is available for CVE-2026-9606. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9606?

Within 24 hours: Identify all systems running itsourcecode Courier Management System 1.0 and isolate from untrusted networks; establish monitoring for SQL injection attempts. Within 7 days: Deploy Web Application Firewall rules to block SQL injection patterns targeting /manage_user.php and implement strict input validation controls. Within 30 days: Contact vendor regarding patch timeline and evaluate replacement options; if no patch is available, operationalize permanent compensating controls.

Courier Management System CVE-2026-9606

Q: What is the CVSS score of CVE-2026-9606?

CVE-2026-9606 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

SQL Injection (CWE-89)

2026-05-26 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 27, 2026 - 00:22 NVD

HIGH MEDIUM

CVSS changed

May 27, 2026 - 00:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

May 27, 2026 - 00:00 vuln.today

DescriptionCVE.org

A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in itsourcecode Courier Management System 1.0 lets remote attackers manipulate the 'ID' parameter of /manage_user.php to inject arbitrary SQL into backend database queries. Per the CVSS vector (PR:N) no authentication is required, and publicly available exploit code exists, though the flaw is not listed in CISA KEV and carries only low (C:L/I:L/A:L) per-impact ratings.

Technical ContextAI

The affected software is itsourcecode Courier Management System 1.0 (cpe:2.3:a:itsourcecode:courier_management_system:*), a PHP/MySQL web application distributed as downloadable source code for managing courier/parcel operations. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the 'ID' argument received by /manage_user.php is concatenated into a SQL query without parameterization or sanitization, allowing an attacker to break out of the intended query context. This is a classic pattern in itsourcecode's PHP projects, where user-supplied request parameters are passed directly into mysqli/mysql query strings.

RemediationAI

No vendor-released patch identified at time of analysis - itsourcecode source projects are frequently unmaintained, so a fixed release may not appear. As compensating controls: fix the code directly by replacing the dynamic query in /manage_user.php with a parameterized/prepared statement (mysqli prepared statements or PDO bound parameters) and cast the 'ID' value to an integer before use, which is the definitive fix and has no functional downside. As interim mitigations, restrict access to /manage_user.php to authenticated administrators via web server or application-level access controls (side effect: none if the page is admin-only, but confirm legitimate callers first), and deploy a WAF rule to block SQL metacharacters in the 'ID' parameter (side effect: possible false positives and bypass via encoding, so treat as detection/slow-down, not a cure). Monitor the VulDB record at https://vuldb.com/vuln/365679 and the publicly disclosed exploit write-up at https://lhzzz08.github.io/posts/cveapplication3/ for changes.