CVE-2026-1135
Cross-Site Scripting in itsourcecode SMS /admin/activity.php
Publication date: 2026-01-19
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| itsourcecode | society_management_system | 1.0 |
| angeljudesuarez | society_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1135 is a cross-site scripting (XSS) vulnerability in the itsourcecode Society Management System version 1.0, specifically in the /admin/activity.php file. It occurs because the application improperly handles the 'title' parameter, allowing attackers to inject malicious scripts that execute in the victim's browser. This happens due to insufficient input validation and output encoding, enabling attackers to run arbitrary JavaScript code remotely without authentication. [2, 3, 4]
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute arbitrary scripts in the context of the victim's browser. Potential impacts include stealing cookies, session tokens, or other sensitive information, performing unauthorized actions on behalf of the victim, defacing web pages, redirecting users to malicious sites, and potentially gaining control over the victim's browser. Exploitation does not require login or authorization but may require user interaction. [2, 3, 4]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the vulnerable endpoint '/admin/activity.php' in the itsourcecode Society Management System 1.0 and testing the 'title' parameter for cross-site scripting (XSS) by injecting typical XSS payloads such as <script>alert('XSS')</script>. Additionally, vulnerable targets can be identified using Google dorking with the query: inurl:admin/activity.php. There is a publicly available proof-of-concept exploit on GitHub that can be used for testing. Specific commands include using curl or browser-based tools to send requests with malicious 'title' parameters and observing if the script executes. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Implement proper output encoding of the 'title' parameter based on context (HTML, JavaScript, etc.) to prevent script execution. 2) Enforce strict input validation and filtering to reject or escape malicious content such as script tags. 3) Deploy a strict Content Security Policy (CSP) to restrict script sources and prevent unauthorized script execution. 4) Set HttpOnly and Secure flags on cookies to protect against theft via JavaScript. 5) Conduct regular security audits to detect and fix XSS vulnerabilities. If possible, replace the affected software with a secure alternative as no official patches are documented. [3, 2, 4]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to inject malicious scripts via cross-site scripting (XSS), which can lead to theft of sensitive information such as cookies and session tokens, unauthorized actions, and potential data exposure. Such security flaws can compromise the integrity and confidentiality of user data, thereby negatively impacting compliance with common standards and regulations like GDPR and HIPAA that require protection of personal and sensitive information. Organizations using the affected software may face increased risk of data breaches and non-compliance due to this vulnerability. [2, 3, 4]