CVE-2026-0586
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability was detected in code-projects Online Product Reservation System 1.0 in the file handgunner-administrator/prod.php. Manipulation of the cat argument allows remote exploitation, and a public exploit may be used.
Risk Assessment
An attacker could execute a malicious script in a victim's browser, potentially leading to session or administrator credential theft.
Recommendation
Update the application to a patched version or enforce input validation and encoding; until then, restrict access to the administrator panel.
Other vulnerabilities in Online Product Reservation System
See all- CVE-2026-0591Medium
A SQL injection vulnerability was identified in code-projects Online Product Reservation System 1.0 in the file /app/checkout/update.php. Manipulation of the id/qty arguments allows remote exploitation, and a public exploit may be used.
- CVE-2026-0590Medium
A SQL injection vulnerability was determined in code-projects Online Product Reservation System 1.0 in the file /app/checkout/delete.php. Manipulation of the ID argument allows remote exploitation, and a public exploit may be used.
Original NVD description (English source)
A vulnerability was detected in code-projects Online Product Reservation System 1.0. The affected element is an unknown function of the file handgunner-administrator/prod.php. Performing a manipulation of the argument cat results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS