CVE-2026-9527
Deferred Deferred - Pending Action
Cross-Site Scripting in Electronic Judging System

Publication date: 2026-05-26

Last updated on: 2026-05-26

Assigner: VulDB

Description
A vulnerability was determined in itsourcecode Electronic Judging System 1.0. This issue affects some unknown processing of the file /admin/judges.php. This manipulation of the argument fname causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-26
Last Modified
2026-05-26
Generated
2026-06-15
AI Q&A
2026-05-26
EPSS Evaluated
2026-06-14
NVD
CVE-2026-9527
EUVD
EUVD-2026-31787
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
itsourcecode electronic_judging_system 1.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The CVE-2026-9527 vulnerability is a Cross-Site Scripting (XSS) issue in the Electronic Judging System version 1.0, specifically in the /admin/judges.php file.

The flaw occurs because user input from the fname parameter is directly output to the web page without proper encoding or filtering, allowing attackers to inject malicious scripts.

This vulnerability can be exploited remotely without requiring login or authorization.

Impact Analysis

Exploitation of this vulnerability can lead to theft of cookies, session tokens, or other sensitive data.

Attackers may perform unauthorized actions, deface web pages, or redirect users to malicious sites.

Detection Guidance

This vulnerability can be detected by testing the /admin/judges.php page for Cross-Site Scripting (XSS) via the fname parameter. You can attempt to inject a simple XSS payload into the fname parameter and observe if it is reflected without proper encoding or filtering.

  • Use curl or wget to send a request with a test XSS payload, for example: curl "http://targetsite/admin/judges.php?fname=<script>alert(1)</script>"
  • Check the response for the presence of the injected script tag without encoding.
  • Use browser developer tools or automated scanners to detect reflected XSS vulnerabilities on the fname parameter.
Mitigation Strategies

Immediate mitigation steps include implementing proper output encoding and input validation on the fname parameter to prevent malicious scripts from being executed.

  • Apply output encoding to all user-supplied data before rendering it on the web page.
  • Implement input validation to restrict or sanitize the fname parameter.
  • Set Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts.
  • Configure cookies with secure and HttpOnly flags to protect session data.
  • Conduct regular security audits to identify and fix similar vulnerabilities.
Compliance Impact

The vulnerability is a Cross-Site Scripting (XSS) issue that allows attackers to inject malicious scripts, potentially leading to theft of cookies, session tokens, or other sensitive data, as well as unauthorized actions. Such data breaches and unauthorized access could negatively impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and disclosure.

However, the provided information does not explicitly discuss the direct impact on compliance with these standards or any specific regulatory consequences.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9527. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart