CVE-2026-10251
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL injection vulnerability was found in itsourcecode Online House Rental System 1.0 in the file /ajax.php?action=login. Manipulating the Username argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
An attacker can bypass the login mechanism and gain unauthorized access to user accounts, potentially leading to data theft or system takeover.
Recommendation
Immediately update the system to the latest version or apply a patch that prevents SQL injection, such as using prepared statements.
Other vulnerabilities in itsourcecode Online House Rental System
See all- CVE-2026-10253High
A SQL injection vulnerability was found in itsourcecode Online House Rental System 1.0 in the file /manage_payment.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-10252High
A SQL injection vulnerability was found in itsourcecode Online House Rental System 1.0 in the file /manage_tenant.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.
Original NVD description (English source)
A weakness has been identified in itsourcecode Online House Rental System 1.0. The impacted element is an unknown function of the file /ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.