CVE-2026-91854

תיאור (מקור, אנגלית)

A vulnerability was identified in code-projects Record Management System 1.0. Affected is an unknown function of the file main/reg.php. Such manipulation of the argument desc leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.

מדדים

CVSS 3.1

4.3 (MEDIUM) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVSS 4.0

2.1 (LOW) מקור הציון: CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-27/9/2026

CWE

CWE-79, CWE-94

קישורים

• https://code-projects.org/
• https://github.com/luciferllll/CVE/blob/main/Record_ManagementSystem%20PHP/Sto‮…
• https://vuldb.com/cve/CVE-2026-91854
• https://vuldb.com/submit/933811
• https://vuldb.com/vuln/404085
• https://vuldb.com/vuln/404085/cti