CVE-2026-86294
MediumCVSS 4.3Summary
In SourceCodester Simple Traffic Offense System 1.0, a vulnerability was found in the file save-settings.php of the Settings Update Endpoint component. Manipulation of the site_name/site_desc arguments leads to cross-site scripting. Remote exploitation is possible, and the exploit has been disclosed.
Risk Assessment
The risk includes the possibility of injecting malicious scripts into a user's browser, potentially leading to data theft, session hijacking, or other attacks.
Recommendation
It is recommended to apply patches or updates immediately, and to validate and sanitize input data to prevent XSS.
Other vulnerabilities in SourceCodester Simple Traffic Offense System
See all- CVE-2026-86293Medium
In SourceCodester Simple Traffic Offense System 1.0, a vulnerability was found in the file delete-user.php of the Deletion Endpoint component. Manipulation of the ID argument leads to missing authentication. The attack can be launched remotely, and the exploit has been published.
- CVE-2026-86292High
A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0 in an unknown function of the file saveuser.php in the User Creation component. Manipulation of the argument position results in missing authentication. The attack may be initiated remotely and the exploit is now public.
Original NVD description (English source)
A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument site_name/site_desc leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.