EUVD-2026-34261
GHSA-gx9q-vg44-8c2c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in itsourcecode Fees Management System up to 1.0. Affected is an unknown function of the file /navbar.php. This manipulation of the argument page causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
AnalysisAI
Reflected cross-site scripting in itsourcecode Fees Management System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session by manipulating the 'page' parameter in /navbar.php. The attack requires user interaction - a victim must follow a crafted URL - limiting mass exploitation, but publicly available exploit code (referenced via a GitHub issue) lowers the barrier for targeted phishing campaigns. No CISA KEV listing; EPSS data was not provided, though the combination of no authentication requirement and public POC warrants prompt attention for exposed deployments.
Technical ContextAI
The affected product is a PHP-based web application (cpe:2.3:a:itsourcecode:fees_management_system:*:*:*:*:*:*:*:*) designed for academic fee management, distributed by itsourcecode.com. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a failure to sanitize or encode the 'page' GET/POST parameter before it is reflected into the HTML output of /navbar.php. In PHP applications, this pattern typically arises when user-supplied input is echoed directly into the DOM without htmlspecialchars() or equivalent output encoding, allowing an attacker to inject script tags or event handlers. The CVSS temporal component E:P (Proof-of-Concept) and RC:R (Reasonable confidence) in the supplied vector confirm exploit availability and reasonable confidence in the vulnerability's existence, while RL:X (Remediation Level: Not Defined) indicates no official fix has been published.
RemediationAI
No vendor-released patch has been identified at time of analysis; the CVSS remediation level RL:X (Not Defined) corroborates the absence of an official fix. Until a patch is released, the following specific compensating controls apply: (1) Disable or restrict public internet access to the Fees Management System - placing it behind a VPN or IP allowlist removes the network-accessible attack surface entirely, though this may disrupt remote access workflows. (2) Deploy a Web Application Firewall (WAF) rule that blocks or sanitizes reflected XSS patterns in the 'page' parameter on requests to /navbar.php - this is effective but may generate false positives if legitimate page names contain special characters. (3) If source code access is available, apply output encoding on the 'page' parameter in /navbar.php using PHP's htmlspecialchars($page, ENT_QUOTES, 'UTF-8') before rendering - this is the most targeted fix with no expected side effects. (4) Implement a Content Security Policy (CSP) header with script-src 'self' to reduce the impact of any successful injection. Monitor VulDB entry https://vuldb.com/cve/CVE-2026-10810 for patch availability.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today