CVE-2026-10297
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability was identified in Fees Management System 1.0 in the file /manage_course.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
A remote attacker can gain unauthorized access to the database, potentially leading to data leakage or modification.
Recommendation
It is recommended to immediately update the Fees Management System to a version containing a patch for SQL injection.
Other vulnerabilities in Fees Management System
See all- CVE-2026-10811Medium
A security vulnerability has been detected in itsourcecode Fees Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /receipt.php. Such manipulation of the argument ef_id leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
- CVE-2026-10810Medium
In itsourcecode Fees Management System up to version 1.0, an XSS vulnerability exists in /navbar.php via manipulation of the page argument. The attack can be performed remotely, and exploit is publicly available.
- CVE-2026-10302Medium
A flaw was found in Fees Management System 1.0 in the file /manage_fee.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-10301Medium
In itsourcecode Fees Management System 1.0, an XSS vulnerability exists in an unknown function of index.php. Manipulating the page argument leads to client-side script execution. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10296Medium
The Fees Management System version 1.0 has an SQL injection vulnerability in /ajax.php via the Username argument. The attack can be performed remotely and the exploit is public.
Original NVD description (English source)
A vulnerability was identified in itsourcecode Fees Management System 1.0. This affects an unknown part of the file /manage_course.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.