CVE-2026-91854
Received Received - Intake

Cross-Site Scripting in Record Management System

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulDB

Description
A vulnerability was identified in code-projects Record Management System 1.0. Affected is an unknown function of the file main/reg.php. Such manipulation of the argument desc leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91854
EUVD
EUVD-2026-78826

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
code-projects record_management_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in the Record Management System 1.0. It exists in the file main/reg.php where the 'desc' argument is not properly sanitized. An attacker can inject malicious scripts via this argument, which executes in the context of the user's browser.

Detection Guidance

To detect this XSS vulnerability in Record Management System 1.0, inspect web traffic for requests to main/reg.php with the desc parameter containing script tags or JavaScript code. Check server logs for unusual input patterns in this parameter. Use tools like Burp Suite or OWASP ZAP to intercept and analyze HTTP requests targeting this endpoint.

Impact Analysis

An attacker could steal sensitive user data like session cookies, redirect users to malicious sites, or perform actions on behalf of users. Since the exploit is publicly available, the risk of real-world attacks is higher.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information, risking compliance with security requirements.

Mitigation Strategies

Immediately update Record Management System to the latest patched version. If no patch exists, implement input validation on the desc parameter in main/reg.php to reject or sanitize HTML/script tags. Deploy a web application firewall to filter malicious inputs. Monitor for exploitation attempts in server logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91854. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart