CVE-2026-10810: itsourcecode Fees Management System navbar.php cross site scripting
A weakness has been identified in itsourcecode Fees Management System up to 1.0. Affected is an unknown function of the file /navbar.php. This manipulation of the argument page causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Place network or application-level protections to reduce exposure: restrict access to the web application and/or /navbar.php to trusted IPs where feasible, and deploy WAF or reverse-proxy rules to block requests containing script payloads or suspicious values in the 'page' parameter.
- Operational
Review and sanitize the 'page' argument handling in /navbar.php: implement strict input validation (allowlist), and apply proper output encoding/escaping to neutralize any injected scripts. Test the changes to confirm the XSS is removed and deploy the fixed code.
- Operational
Search web and application logs for requests to /navbar.php and attempts to inject or execute scripts via the 'page' parameter; if exploitation is found, perform incident response (containment and investigation) and remediate affected systems.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10810?
The severity of CVE-2026-10810 is classified as low with a score of 2.1.
How can I fix CVE-2026-10810?
To fix CVE-2026-10810, ensure proper validation and sanitization of user input in the navbar.php file.
What type of vulnerability is CVE-2026-10810?
CVE-2026-10810 is a cross-site scripting (XSS) vulnerability.
Can CVE-2026-10810 be exploited remotely?
Yes, CVE-2026-10810 can be exploited remotely by manipulating the argument in navbar.php.
What software is affected by CVE-2026-10810?
CVE-2026-10810 affects the itsourcecode Fees Management System up to version 1.0.