CVE-2026-102264
Received Received - Intake

XSS in Robo-Cafe RMS Edit Profile Feature

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: VulDB

Description
A vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The impacted element is an unknown function of the file frontend/update-account.php of the component Edit Profile Feature. Performing a manipulation of the argument Name/Address/City results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-102264
EUVD
EUVD-2026-88640

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mwasikz robo-cafe-rms to 228c44a02823f04e85db32b7137809a2856148fc (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a reflected cross-site scripting (XSS) issue in the robo-cafe-rms software. It exists in the Edit Profile Feature, specifically in the frontend/update-account.php file. Attackers can manipulate the Name, Address, or City fields to inject malicious scripts. The exploit is publicly available and can be used remotely.

Detection Guidance

This vulnerability involves reflected cross-site scripting (XSS) in the Edit Profile Feature of robo-cafe-rms. To detect it, inspect web application logs for unusual input patterns in the Name, Address, or City fields of the frontend/update-account.php endpoint. Look for requests containing script tags or other HTML/JavaScript payloads. Use tools like curl to test the endpoint with crafted inputs, e.g., curl 'http://target/frontend/update-account.php?name=<script>alert(1)</script>'.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary scripts in your browser when you visit the affected page. This may lead to session hijacking, theft of cookies or sensitive data, or redirection to malicious sites. Users with accounts in the system are at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection. Organizations using this software may face compliance violations, potential fines, and reputational damage if exploited.

Mitigation Strategies

Immediately apply input validation and output encoding to the Name, Address, and City fields in the Edit Profile Feature. Sanitize user inputs to block HTML/JavaScript tags. Update to the latest version of robo-cafe-rms if available. If no patch exists, consider disabling the Edit Profile Feature temporarily or restricting access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102264. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart