CVE-2026-9527
BaseFortify
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| itsourcecode | electronic_judging_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The CVE-2026-9527 vulnerability is a Cross-Site Scripting (XSS) issue in the Electronic Judging System version 1.0, specifically in the /admin/judges.php file.
The flaw occurs because user input from the fname parameter is directly output to the web page without proper encoding or filtering, allowing attackers to inject malicious scripts.
This vulnerability can be exploited remotely without requiring login or authorization.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to theft of cookies, session tokens, or other sensitive data.
Attackers may perform unauthorized actions, deface web pages, or redirect users to malicious sites.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the /admin/judges.php page for Cross-Site Scripting (XSS) via the fname parameter. You can attempt to inject a simple XSS payload into the fname parameter and observe if it is reflected without proper encoding or filtering.
- Use curl or wget to send a request with a test XSS payload, for example: curl "http://targetsite/admin/judges.php?fname=<script>alert(1)</script>"
- Check the response for the presence of the injected script tag without encoding.
- Use browser developer tools or automated scanners to detect reflected XSS vulnerabilities on the fname parameter.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing proper output encoding and input validation on the fname parameter to prevent malicious scripts from being executed.
- Apply output encoding to all user-supplied data before rendering it on the web page.
- Implement input validation to restrict or sanitize the fname parameter.
- Set Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts.
- Configure cookies with secure and HttpOnly flags to protect session data.
- Conduct regular security audits to identify and fix similar vulnerabilities.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a Cross-Site Scripting (XSS) issue that allows attackers to inject malicious scripts, potentially leading to theft of cookies, session tokens, or other sensitive data, as well as unauthorized actions. Such data breaches and unauthorized access could negatively impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and disclosure.
However, the provided information does not explicitly discuss the direct impact on compliance with these standards or any specific regulatory consequences.