CVE-2026-9527: itsourcecode Electronic Judging System judges.php cross site scripting
A vulnerability was determined in itsourcecode Electronic Judging System 1.0. This issue affects some unknown processing of the file /admin/judges.php. This manipulation of the argument fname causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
itsourcecode Electronic Judging System 1.0from your environment.If the application or the /admin/judges.php functionality is not required, uninstall the application or remove/disable the judges.php script until a proper code fix is implemented.
- Configuration
Validate and sanitize the fname parameter on input (restrict to an allowlist of expected characters) and apply proper output encoding (HTML entity encoding) before rendering to prevent Cross-Site Scripting.
itsourcecode Electronic Judging System /admin/judges.php fname input handling = validate and HTML-encode/sanitize fname - Configuration
Ensure all /admin pages require strong authentication and authorization; restrict administrative functionality to authorized accounts and minimize privileges for admin users.
itsourcecode Electronic Judging System (admin interface) admin access control = require authentication and restrict access - Compensating control
Restrict access to /admin/judges.php at the network or webserver level (firewall, webserver allow/deny, or IP allowlist) and deploy WAF rules to detect/block XSS payloads targeting the fname parameter.
- Operational
Review webserver and application logs for requests to /admin/judges.php and occurrences of the fname parameter for signs of exploitation; investigate and remediate any impacted accounts or injected content.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9527?
CVE-2026-9527 has a medium severity score of 4.3.
How do I fix CVE-2026-9527?
To fix CVE-2026-9527, ensure input validation is implemented on the fname parameter in the /admin/judges.php file.
What type of vulnerability is CVE-2026-9527?
CVE-2026-9527 is a cross site scripting (XSS) vulnerability.
Can CVE-2026-9527 be exploited remotely?
Yes, CVE-2026-9527 allows for remote exploitation of the system.
What software is affected by CVE-2026-9527?
CVE-2026-9527 affects the itsourcecode Electronic Judging System version 1.0.