CVE-2026-10256
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A SQL injection vulnerability was found in itsourcecode Content Management System 1.0 in the file /save_comment.php via the Name argument. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
An attacker can execute arbitrary SQL queries against the database, potentially leading to data theft, modification, or full application compromise.
Recommendation
Apply a security fix immediately, such as input validation and using parameterized SQL queries.
Other vulnerabilities in itsourcecode Content Management System
See all- CVE-2026-10265Medium
A SQL injection vulnerability was found in itsourcecode Content Management System 1.0 in the file /admin/edit_topic.php via the topic_id argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10258Medium
A SQL injection vulnerability was found in itsourcecode Content Management System 1.0 in the file /admin/add_sub_topic.php via the topic_id argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10257Medium
A SQL injection vulnerability was found in itsourcecode Content Management System 1.0 in the file /admin/update_ss_img.php via the topic_id argument. The attack can be performed remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was identified in itsourcecode Content Management System 1.0. This vulnerability affects unknown code of the file /save_comment.php. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.