CVE-2026-86293
MediumCVSS 6.5Summary
In SourceCodester Simple Traffic Offense System 1.0, a vulnerability was found in the file delete-user.php of the Deletion Endpoint component. Manipulation of the ID argument leads to missing authentication. The attack can be launched remotely, and the exploit has been published.
Risk Assessment
The risk includes the possibility of remotely deleting users without authentication, potentially leading to unauthorized changes in the system.
Recommendation
It is recommended to apply patches or updates immediately and enforce authentication for all deletion operations.
Other vulnerabilities in SourceCodester Simple Traffic Offense System
See all- CVE-2026-86294Medium
In SourceCodester Simple Traffic Offense System 1.0, a vulnerability was found in the file save-settings.php of the Settings Update Endpoint component. Manipulation of the site_name/site_desc arguments leads to cross-site scripting. Remote exploitation is possible, and the exploit has been disclosed.
- CVE-2026-86292High
A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0 in an unknown function of the file saveuser.php in the User Creation component. Manipulation of the argument position results in missing authentication. The attack may be initiated remotely and the exploit is now public.
Original NVD description (English source)
A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this vulnerability is an unknown functionality of the file delete-user.php of the component Deletion Endpoint. Executing a manipulation of the argument ID can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used.