rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-10722 cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow
A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.
Problem types: cwe_id: CWE-190
description: Integer Overflow
cwe_id: CWE-189
description: Numeric Error
Affected products: vendor: cilium
product: ebpf
cpes: cpe:2.3:a:cilium:ebpf:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
baseSeverity: LOW
Credits: lang: en
value: alifiras (VulDB User)
lang: en
value: alifiras (VulDB User)
Published: 2026-06-03T10:45:10.269Z
CVE-2026-10725 Protocol::HTTP2 versions through 1.12 for Perl is vulnerable to a HTTP/2 Bomb
Protocol::HTTP2 versions through 1.12 for Perl is vulnerable to a HTTP/2 Bomb.

Protocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the "HTTP/2 bomb").

The headers_decode method materialises a full key+value copy per indexed reference with no running size check, and the stream_header_block_add method appends (since version 1.12) every CONTINUATION frame to the per-stream buffer unbounded.

MAX_HEADER_LIST_SIZE (default 65536) is advertised in SETTINGS but never consulted on decode.  It is absent from the decoder and from the :limits export tag.
Problem types: cwe_id: CWE-409
description: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
Affected products: vendor: CRUX
product: Protocol::HTTP2
default_status: unaffected
Published: 2026-06-06T09:14:45.652Z
CVE-2026-10729 HTML injection in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens
An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails.


This issue affects Canarytokens: from Docker tag sha-c42435e before sha-bfda4df, from Git commit c42435e before bfda4df.
Problem types: cwe_id: CWE-74
description: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: Thinkst Applied Research
product: Canarytokens
default_status: unaffected
Credits: lang: en
value: Gaurav Popalghat
Published: 2026-06-03T13:02:15.195Z
CVE-2026-10732 
All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two entries with the same path - the first being a symlink to an arbitrary target and the second being a regular file - the file content is written through the symlink to the target location outside the output directory. This is due to the microtask processing order that checks readlink for the second file before resolving symlink for the first file. An attacker can write arbitrary file on the host filesystem potentially leading to remote code execution by providing a specially crafted ZIP archive.**Note:**This bypasses all existing path traversal protections including preventWritingThroughSymlink, added as a part of the fix for [CVE-2020-12265](https://security.snyk.io/vuln/SNYK-JS-DECOMPRESS-557358).
Problem types: cwe_id: CWE-29
description: Arbitrary File Write via Archive Extraction (Zip Slip)
Affected products: vendor: n/a
product: decompress
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: LOW
baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L/E:P
Credits: lang: en
value: Alessandro Mizzaro
Published: 2026-06-05T05:00:02.896Z
CVE-2026-10737 SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function
The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive information. The authorization gate uses a negated nonce check OR-chained with permission checks, meaning a missing or invalid nonce causes the entire condition to evaluate to true and bypass all preceding capability and ownership checks. The secondary fallback check only denies access for root-level files (pid == 0), leaving all files stored inside project folders fully exposed to unauthenticated users who supply only a valid file ID in a POST request to admin-ajax.php.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: smartypants
product: SP Project & Document Manager
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: NamDang
Published: 2026-06-04T01:26:44.640Z
CVE-2026-10766 mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hash
A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
Problem types: cwe_id: CWE-328
description: Use of Weak Hash
cwe_id: CWE-327
description: Risky Cryptographic Algorithm
Affected products: vendor: n/a
product: mlrun
cpes: cpe:2.3:a:mlrun:mlrun:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 3.6
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Dem0 (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-03T20:00:11.168Z
CVE-2026-10771 crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery
A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java of the component base64 Qrcode Endpoint. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery
Affected products: vendor: crmeb
product: crmeb_java
cpes: cpe:2.3:a:crmeb:crmeb_java:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: mukyuuhate (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-03T21:30:09.322Z
CVE-2026-10775 sgl-project SGLang Cache data_hash denial of service
A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulnerability is the function data_hash of the component Cache Handler. This manipulation causes denial of service. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
Problem types: cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: sgl-project
product: SGLang
cpes: cpe:2.3:a:sgl-project:sglang:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 3.6
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Dem0 (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-03T22:15:10.154Z
CVE-2026-10777 ealpha072 Student-Management-System Administrative Backend config.php improper authentication
A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-287
description: Improper Authentication
Affected products: vendor: ealpha072
product: Student-Management-System
cpes: cpe:2.3:a:ealpha072:student-management-system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: AAAAAlln1 (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-03T22:30:08.399Z
CVE-2026-10783 gradio-app gradio Audio Cache Key save_audio_to_cache weak hash
A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache Key Handler. Performing a manipulation results in use of weak hash. The attack must be initiated from a local position. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The patch is named 13394. To fix this issue, it is recommended to deploy a patch.
Problem types: cwe_id: CWE-328
description: Use of Weak Hash
cwe_id: CWE-327
description: Risky Cryptographic Algorithm
Affected products: vendor: gradio-app
product: gradio
cpes: cpe:2.3:a:gradio-app:gradio:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 2.5
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
baseSeverity: LOW
Credits: lang: en
value: Dem0 (VulDB User)
Published: 2026-06-03T23:30:12.545Z
CVE-2026-10786 
Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request.

This issue affects :

  *  Devolutions Server 2026.2.4.0
  *  Devolutions Server 2026.1.20.0 and earlier
Problem types: cwe_id: CWE-312
description: CWE-312 Cleartext storage of sensitive information
Affected products: vendor: Devolutions
product: Server
default_status: unaffected
Published: 2026-06-08T18:26:09.352Z
CVE-2026-10787 
Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groups via a crafted API request.

This issue affects :

  *  Devolutions Server 2026.2.4.0
  *  Devolutions Server 2026.1.20.0 and earlier
Problem types: cwe_id: CWE-862
description: CWE-862 Missing authorization
Affected products: vendor: Devolutions
product: Server
default_status: unaffected
Published: 2026-06-08T18:26:25.970Z
CVE-2026-10796 nvm executes commands from a malicious Node.js mirror's version strings
nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as `nvm install` read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs and shell/awk commands. Two sinks are affected by the same untrusted input: nvm_download() built a curl/wget command string and ran it with `eval`, so a version field containing command substitution (for example $(id)) was executed by the local shell; and nvm_get_checksum() interpolated the version-derived download slug into an awk program, so a crafted version could execute arbitrary commands via awk's system(). An attacker who controls the configured mirror, supplies mirror content to a user or CI on a non-default mirror, or machine-in-the-middles a non-TLS mirror can ∴ run arbitrary commands with the privileges of the user running nvm. The default mirror (https://nodejs.org over TLS) is not affected. Fixed on master (pending the next tagged release) by passing every argument as a literal argv element instead of using eval, by passing the value to awk as data via -v instead of interpolating it into the program, and by rejecting any version outside the Node.js/io.js version grammar before it is used.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: nvm-sh
product: nvm
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Credits: lang: en
value: DavidCarliez reported the `nvm_download` eval sink
lang: en
value: `nvm_get_checksum` `awk` sink was identified during remediation via an internal audit, fixed by ljharb
Published: 2026-06-04T17:02:23.805Z
CVE-2026-10800 PaddlePaddle FastDeploy MultimodalHasher hasher.py hash_features weak hash
A weakness has been identified in PaddlePaddle FastDeploy up to 2.4.1. Affected by this issue is the function hash_features of the file fastdeploy/multimodal/hasher.py of the component MultimodalHasher. Executing a manipulation can lead to use of weak hash. The attack requires local access. A high complexity level is associated with this attack. The exploitation is known to be difficult. This patch is called 374945747652a8d32965591c0c01a00c88b7067f. Applying a patch is advised to resolve this issue.
Problem types: cwe_id: CWE-328
description: Use of Weak Hash
cwe_id: CWE-327
description: Risky Cryptographic Algorithm
Affected products: vendor: PaddlePaddle
product: FastDeploy
cpes: cpe:2.3:a:paddlepaddle:fastdeploy:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 3.6
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C
baseSeverity: LOW
Credits: lang: en
value: Dem0 (VulDB User)
Published: 2026-06-04T09:45:12.021Z
CVE-2026-10801 modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hash
A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template._save_pil_image of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A high degree of complexity is needed for the attack. It is indicated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.
Problem types: cwe_id: CWE-328
description: Use of Weak Hash
cwe_id: CWE-327
description: Risky Cryptographic Algorithm
Affected products: vendor: modelscope
product: ms-swift
cpes: cpe:2.3:a:modelscope:ms-swift:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 3.6
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Dem0 (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-04T11:00:13.074Z
CVE-2026-10802 keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption
A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.
Problem types: cwe_id: CWE-400
description: Resource Consumption
cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: keystonejs
product: keystone
cpes: cpe:2.3:a:keystonejs:keystone:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: nedlir (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-04T11:15:10.397Z
CVE-2026-10803 MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash
A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component Dataset Digest Computation. This manipulation causes use of weak hash. It is possible to launch the attack on the local host. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
Problem types: cwe_id: CWE-328
description: Use of Weak Hash
cwe_id: CWE-327
description: Risky Cryptographic Algorithm
Affected products: vendor: n/a
product: MLflow
cpes: cpe:2.3:a:mlflow:mlflow:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 3.6
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Dem0 (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-04T11:45:10.363Z
CVE-2026-10804 Streamlit Palette hashing.py weak hash
A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
Problem types: cwe_id: CWE-328
description: Use of Weak Hash
cwe_id: CWE-327
description: Risky Cryptographic Algorithm
Affected products: vendor: n/a
product: Streamlit
cpes: cpe:2.3:a:streamlit:streamlit:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 3.6
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C
baseSeverity: LOW
Credits: lang: en
value: Dem0 (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-04T12:00:14.916Z
CVE-2026-10806 mjperpinosa stumasy add_post.php unrestricted upload
A vulnerability was found in mjperpinosa stumasy. The affected element is an unknown function of the file application/PHP/objects/updates/add_post.php. Performing a manipulation of the argument up_file_to_post results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-434
description: Unrestricted Upload
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: mjperpinosa
product: stumasy
cpes: cpe:2.3:a:mjperpinosa:stumasy:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: cnluminous (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-04T12:15:10.177Z
CVE-2026-10807 mjperpinosa stumasy change_profile_image.php unrestricted upload
A vulnerability was determined in mjperpinosa stumasy. The impacted element is an unknown function of the file application/PHP/objects/profiles/change_profile_image.php. Executing a manipulation of the argument pr_profile_image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-434
description: Unrestricted Upload
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: mjperpinosa
product: stumasy
cpes: cpe:2.3:a:mjperpinosa:stumasy:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: j1nk1ng (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-04T12:30:12.057Z
CVE-2026-10808 itsourcecode Fees Management System manage_student.php sql injection
A vulnerability was identified in itsourcecode Fees Management System 1.0. This affects an unknown function of the file /manage_student.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Fees Management System
cpes: cpe:2.3:a:itsourcecode:fees_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: hajimi (VulDB User)
Published: 2026-06-04T12:45:09.110Z
CVE-2026-10809 itsourcecode Fees Management System manage_user.php sql injection
A security flaw has been discovered in itsourcecode Fees Management System 1.0. This impacts an unknown function of the file /manage_user.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Fees Management System
cpes: cpe:2.3:a:itsourcecode:fees_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: repentance (VulDB User)
Published: 2026-06-04T13:00:11.451Z
CVE-2026-10810 itsourcecode Fees Management System navbar.php cross site scripting
A weakness has been identified in itsourcecode Fees Management System up to 1.0. Affected is an unknown function of the file /navbar.php. This manipulation of the argument page causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: itsourcecode
product: Fees Management System
cpes: cpe:2.3:a:itsourcecode:fees_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: outjinmswa (VulDB User)
Published: 2026-06-04T13:15:10.861Z