CVE-2026-6034

MediumCVSS 4.3

Published: 10/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

A vulnerability was found in code-projects Vehicle Showroom Management System 1.0 in the file /BranchManagement/ProfitAndLossReport.php. Manipulating the BRANCH_ID argument leads to cross-site scripting. The attack can be launched remotely and a public exploit is available.

Risk Assessment

An attacker could execute malicious script in the application user's browser, potentially stealing session or credential data. The risk affects organizations running this application exposed to network access.

Recommendation

Update the application to a patched version or enforce input validation and encoding for the BRANCH_ID parameter. Until patched, restrict access to trusted networks.

Other vulnerabilities in Vehicle Showroom Management System

CVE-2026-6035Medium
In code-projects Vehicle Showroom Management System 1.0, in /BranchManagement/ServiceAndSalesReport.php, manipulation of the BRANCH_ID argument leads to cross-site scripting. The attack is remotely exploitable, and the exploit has been publicly disclosed and may be used.

Original NVD description (English source)

A flaw has been found in code-projects Vehicle Showroom Management System 1.0. Impacted is an unknown function of the file /BranchManagement/ProfitAndLossReport.php. Executing a manipulation of the argument BRANCH_ID can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS