CVE-2026-90795

Deferred Deferred - Pending Action

Cross-Site Scripting in Loan Management System 1.0

Publication date: 2026-09-14

Last updated on: 2026-09-15

Assigner: VulDB

Description

A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-15

Generated

2026-09-15

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-90795

EUVD

EUVD-2026-77582

Affected Vendors & Products

Vendor	Product	Version / Range
itsourcecode	loan_management_system	1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in Loan Management System 1.0's navbar.php file. It occurs because the 'page' URL parameter is not properly sanitized, allowing attackers to inject malicious JavaScript code that executes in a victim's browser. The flaw enables attackers to manipulate user sessions without authentication.

Detection Guidance

To detect this XSS vulnerability in Loan Management System 1.0, inspect the navbar.php file for unsanitized 'page' parameter handling. Test by appending crafted payloads to URLs like ?page=<script>alert(1)</script> and observe if JavaScript executes. Check server logs for unusual requests targeting navbar.php with XSS payloads.

Impact Analysis

An attacker could exploit this to steal session cookies, perform unauthorized actions on your behalf, redirect you to malicious sites, or deliver malware. Simply visiting a crafted URL could trigger the attack, even without logging in.

Compliance Impact

This XSS vulnerability could lead to data theft, session hijacking, or unauthorized actions, which may violate GDPR's data protection requirements (e.g., Article 32 on security of processing) and HIPAA's safeguards for protected health information (e.g., 45 CFR § 164.308(a)(1)(ii)(A)). Non-compliance risks include fines, legal penalties, and reputational damage due to insufficient protection against cross-site scripting attacks.

Mitigation Strategies

Immediately sanitize the 'page' parameter input in navbar.php using allow-lists or strict validation. Apply output encoding with htmlspecialchars() or htmlentities() before rendering user input. Deploy security headers like Content-Security-Policy and X-XSS-Protection to mitigate XSS risks.

Hi! I’m here to help you understand CVE-2026-90795. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70