CVE-2026-10810
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In itsourcecode Fees Management System up to version 1.0, an XSS vulnerability exists in /navbar.php via manipulation of the page argument. The attack can be performed remotely, and exploit is publicly available.
Risk Assessment
An attacker can inject a malicious script that executes in the administrator's browser, leading to session theft, defacement, or theft of fee data.
Recommendation
Apply input filtering for the page argument in /navbar.php and use output encoding. Consider updating the system.
Other vulnerabilities in Fees Management System
See all- CVE-2026-10811Medium
A security vulnerability has been detected in itsourcecode Fees Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /receipt.php. Such manipulation of the argument ef_id leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
- CVE-2026-10302Medium
A flaw was found in Fees Management System 1.0 in the file /manage_fee.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-10301Medium
In itsourcecode Fees Management System 1.0, an XSS vulnerability exists in an unknown function of index.php. Manipulating the page argument leads to client-side script execution. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10297Medium
A vulnerability was identified in Fees Management System 1.0 in the file /manage_course.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-10296Medium
The Fees Management System version 1.0 has an SQL injection vulnerability in /ajax.php via the Username argument. The attack can be performed remotely and the exploit is public.
Original NVD description (English source)
A weakness has been identified in itsourcecode Fees Management System up to 1.0. Affected is an unknown function of the file /navbar.php. This manipulation of the argument page causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.