CVE-2026-10296
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Fees Management System version 1.0 has an SQL injection vulnerability in /ajax.php via the Username argument. The attack can be performed remotely and the exploit is public.
Risk Assessment
An attacker can remotely manipulate the database, potentially leading to data leakage, modification, or deletion.
Recommendation
Apply a patch immediately or replace the system with a more secure solution.
Other vulnerabilities in Fees Management System
See all- CVE-2026-10811Medium
A security vulnerability has been detected in itsourcecode Fees Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /receipt.php. Such manipulation of the argument ef_id leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
- CVE-2026-10810Medium
In itsourcecode Fees Management System up to version 1.0, an XSS vulnerability exists in /navbar.php via manipulation of the page argument. The attack can be performed remotely, and exploit is publicly available.
- CVE-2026-10302Medium
A flaw was found in Fees Management System 1.0 in the file /manage_fee.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-10301Medium
In itsourcecode Fees Management System 1.0, an XSS vulnerability exists in an unknown function of index.php. Manipulating the page argument leads to client-side script execution. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10297Medium
A vulnerability was identified in Fees Management System 1.0 in the file /manage_course.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was determined in itsourcecode Fees Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.