CVE-2026-10257
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A SQL injection vulnerability was found in itsourcecode Content Management System 1.0 in the file /admin/update_ss_img.php via the topic_id argument. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
An attacker can execute arbitrary SQL queries against the database, potentially leading to data theft, modification, or full application compromise.
Recommendation
Apply a security fix immediately, such as input validation and using parameterized SQL queries.
Other vulnerabilities in itsourcecode Content Management System
See all- CVE-2026-10265Medium
A SQL injection vulnerability was found in itsourcecode Content Management System 1.0 in the file /admin/edit_topic.php via the topic_id argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10258Medium
A SQL injection vulnerability was found in itsourcecode Content Management System 1.0 in the file /admin/add_sub_topic.php via the topic_id argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10256Medium
A SQL injection vulnerability was found in itsourcecode Content Management System 1.0 in the file /save_comment.php via the Name argument. The attack can be performed remotely, and the exploit is publicly available.
Original NVD description (English source)
A security flaw has been discovered in itsourcecode Content Management System 1.0. This issue affects some unknown processing of the file /admin/update_ss_img.php. The manipulation of the argument topic_id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.