CVE-2026-10301
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In itsourcecode Fees Management System 1.0, an XSS vulnerability exists in an unknown function of index.php. Manipulating the page argument leads to client-side script execution. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, redirects, or other security-compromising actions.
Recommendation
Update Fees Management System to a patched version or apply input filtering for the page parameter.
Other vulnerabilities in Fees Management System
See all- CVE-2026-10811Medium
A security vulnerability has been detected in itsourcecode Fees Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /receipt.php. Such manipulation of the argument ef_id leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
- CVE-2026-10810Medium
In itsourcecode Fees Management System up to version 1.0, an XSS vulnerability exists in /navbar.php via manipulation of the page argument. The attack can be performed remotely, and exploit is publicly available.
- CVE-2026-10302Medium
A flaw was found in Fees Management System 1.0 in the file /manage_fee.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-10297Medium
A vulnerability was identified in Fees Management System 1.0 in the file /manage_course.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-10296Medium
The Fees Management System version 1.0 has an SQL injection vulnerability in /ajax.php via the Username argument. The attack can be performed remotely and the exploit is public.
Original NVD description (English source)
A vulnerability was detected in itsourcecode Fees Management System 1.0. The affected element is an unknown function of the file index.php. Performing a manipulation of the argument page results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used.