EUVD-2026-14527Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v3.1 base score of 3.5 reflects a low-severity impact profile: the attack requires prior authentication (PR:L), user interaction (UI:R), and the integrity impact is limited (I:L with no confidentiality or availability impact). However, the CVSS vector includes E:P (Proof-of-Concept Exists) and RL:X (Remediation Level Unknown), signaling active public disclosure. The EPSS metric is not explicitly provided, but given the low CVSS score, publicly available POC, and requirement for authenticated access plus user interaction, real-world exploitation risk is moderate and context-dependent. This is NOT a critical zero-day; rather, it is a low-impact but easily exploitable vulnerability affecting a niche application. Prioritization should be moderate: patch it as part of regular updates, but do not deprioritize other work. If the Lawyer Management System is internet-facing and handles sensitive client data, remediate within 30 days; if internal-only, it may be lower priority. |
| Exploit ScenarioDerived | A malicious user with legitimate credentials to the Lawyer Management System crafts a URL containing JavaScript in the first_Name parameter (e.g., /lawyers.php?first_Name=<script>alert('XSS')</script>) and tricks a colleague into clicking the link via email or chat. When the colleague clicks the link and the page renders, the injected script executes in their browser, potentially stealing their session cookie or redirecting them to a phishing site. Since a public proof-of-concept is available on GitHub, an attacker with system access or who has compromised a low-privilege account can easily adapt the POC for targeted attacks within the organization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
A stored or reflected cross-site scripting (XSS) vulnerability exists in projectworlds Lawyer Management System version 1.0, specifically in the /lawyers.php file where the first_Name parameter is inadequately sanitized. An authenticated attacker can inject malicious JavaScript that executes in the context of other users' browsers, potentially stealing session tokens or performing unauthorized actions. A public proof-of-concept exploit is available, and exploitation requires only low complexity with user interaction (UI:R), though the attack vector is network-accessible and does not require high privileges.
RemediationAI
The primary remediation is to upgrade projectworlds Lawyer Management System to a patched version when available; check the vendor's website and VulDB (https://vuldb.com/?id.352434) for patch availability and timeline. In the interim, implement input validation and output encoding in the /lawyers.php file: ensure the first_Name parameter is validated against a whitelist (alphanumeric and safe characters only) and encoded using htmlspecialchars($input, ENT_QUOTES, 'UTF-8') before rendering in HTML context. Additionally, enforce Content Security Policy (CSP) headers to restrict inline script execution and mitigate XSS impact. Limit access to the /lawyers.php endpoint to trusted internal networks if possible, and enforce HTTPS with secure session cookies (HttpOnly, Secure flags) to protect authenticated sessions from token theft.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic input validation weakness in web applications. The affected software is projectworlds Lawyer Management System (CPE: cpe:2.3:a:projectworlds:lawyer_management_system:*:*:*:*:*:*:*:*), a PHP-based application. The root cause is the failure to properly encode or validate user-supplied input in the first_Name parameter before reflecting it back in the HTML response of /lawyers.php. Since the application is PHP-based and processes user input without sanitization (likely missing htmlspecialchars() or equivalent output encoding), an attacker can inject script tags or event handlers that execute client-side in the victim's browser when the page is rendered.
Know when Lawyer Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in projectworlds Lawyer Management System 1.0. This issue affects some unknown processing of the file /lawyers.php. The manipulation of the argument first_Name leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.
Executive ViewAI
CVE-2026-4596 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 3.5). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard cross-site scripting mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB