CVE-2026-9606
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Risk Assessment
An attacker can remotely manipulate the courier management system database, potentially leading to data leakage or takeover.
Recommendation
Immediately update the Courier Management System or apply a patch to prevent SQL injection.
Other vulnerabilities in Courier Management System
See all- CVE-2026-16229Medium
In Courier Management System up to version 1.0, a flaw exists in /index.php. Manipulation of the page parameter leads to cross-site scripting (XSS). The attack can be launched remotely, and an exploit has been published.
- CVE-2026-9607Medium
In itsourcecode Courier Management System 1.0, an unknown function in the file /parcel_list.php is vulnerable to SQL Injection via manipulation of the argument s. The attack can be performed remotely, and the exploit has been made public.
Original NVD description (English source)
A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.