CVE-2026-16229
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In Courier Management System up to version 1.0, a flaw exists in /index.php. Manipulation of the page parameter leads to cross-site scripting (XSS). The attack can be launched remotely, and an exploit has been published.
Risk Assessment
An attacker can inject a malicious script that executes in the victim's browser, leading to session theft, redirects, or data theft.
Recommendation
Update the system to the latest version or apply a patch that prevents XSS. Restrict access to the admin panel.
Other vulnerabilities in Courier Management System
See all- CVE-2026-9607Medium
In itsourcecode Courier Management System 1.0, an unknown function in the file /parcel_list.php is vulnerable to SQL Injection via manipulation of the argument s. The attack can be performed remotely, and the exploit has been made public.
- CVE-2026-9606High
A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Original NVD description (English source)
A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.