CVE-2026-6035

27th percentile - higher than 27% of all known CVEs

In code-projects Vehicle Showroom Management System 1.0, in /BranchManagement/ServiceAndSalesReport.php, manipulation of the BRANCH_ID argument leads to cross-site scripting. The attack is remotely exploitable, and the exploit has been publicly disclosed and may be used.

An attacker can execute arbitrary JavaScript in the victim's browser, e.g., to steal sessions or credentials. Public disclosure of the exploit increases the likelihood of exploitation.

Apply the vendor patch or implement validation and encoding of the BRANCH_ID argument in ServiceAndSalesReport.php. Consider deploying a Content-Security-Policy header.