CVE-2026-86294— SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting
Quick assessment
Affected
SourceCodester Simple Traffic Offense System
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SourceCodester Simple Traffic Offense System是SourceCodester社区的一款交通违法记录与处理系统。 SourceCodester Simple Traffic Offense System 1.0版本存在安全漏洞，该漏洞源于对save-settings.php文件中参数site_name/site_desc的错误操作，可能导致跨站脚本攻击。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SourceCodester | Simple Traffic Offense System | 1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86294
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument site_name/site_desc leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
SourceCodester Simple Traffic Offense System 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SourceCodester Simple Traffic Offense System是SourceCodester社区的一款交通违法记录与处理系统。 SourceCodester Simple Traffic Offense System 1.0版本存在安全漏洞，该漏洞源于对save-settings.php文件中参数site_name/site_desc的错误操作，可能导致跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SourceCodester | Simple Traffic Offense System | 1.0 |
cpe:2.3:a:sourcecodester:simple_traffic_offense_system:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-86294
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86294
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-86294 (1)
-
🔗 VulDB | Security Check third-party-advisory
Proof of Concept for CVE-2026-86294 (1)
Other References for CVE-2026-86294 (3)
-
🔗 CVE-2026-86294 in Simple Traffic Offense System third-party-advisory
-
🔗 CVE-2026-86294 SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting vdb-entry technical-description
Same Patch Batch · SourceCodester · 2026-09-07 · 12 CVEs total
| CVE-2026-86298 | 7.3 HIGH | SourceCodester Class and Exam Timetabling System delete_subject.php sql injection |
| CVE-2026-86292 | 7.3 HIGH | SourceCodester Simple Traffic Offense System User Creation saveuser.php missing authentica |
| CVE-2026-86290 | 7.3 HIGH | SourceCodester Online Voting System ajax.php save_category sql injection |
| CVE-2026-86277 | 7.3 HIGH | SourceCodester Syllabus-Aligned Learning Management & Examination System delete_exam.php a |
| CVE-2026-86276 | 7.3 HIGH | SourceCodester Syllabus-Aligned Learning Management & Examination System db.php hard-coded |
| CVE-2026-86293 | 6.5 MEDIUM | SourceCodester Simple Traffic Offense System Deletion Endpoint delete-user.php missing aut |
| CVE-2026-86279 | 6.3 MEDIUM | SourceCodester Syllabus-Aligned Learning Management & Examination System Login auth_proces |
| CVE-2026-86280 | 5.3 MEDIUM | SourceCodester Syllabus-Aligned Learning Management & Examination System cict_portal.sql c |
| CVE-2026-86275 | 5.3 MEDIUM | SourceCodester Syllabus-Aligned Learning Management & Examination System auth.php register |
| CVE-2026-86281 | 4.3 MEDIUM | SourceCodester Syllabus-Aligned Learning Management & Examination System cross-site reques |
| CVE-2026-86278 | 4.3 MEDIUM | SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.p |
IV. Related Vulnerabilities
Same vendor: SourceCodester
-
CVE-2026-114267
SourceCodester Food Order Management System Admin Endpoint a -
CVE-2026-112097
SourceCodester Inventory System Sales Management transaction -
CVE-2026-112096
SourceCodester Inventory System Purchase Records transaction -
CVE-2026-112095
SourceCodester Inventory System Product Management products_ -
CVE-2026-109620
SourceCodester Online Reviewer System index.php prepare sql
Same weakness: CWE-79
-
CVE-2026-115897
Serialize JavaScript: Cross-site scripting (XSS) via unescap -
CVE-2026-87901
注册模块不当清理导致反射型跨站脚本漏洞 -
CVE-2026-102786
Joomla Extension - phoca.cz - Authenticated stored cross-sit -
CVE-2026-55486
Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — C -
CVE-2026-112333
GFI Archiver < 15.14 Stored XSS via MailInsights.aspx
V. Comments for CVE-2026-86294
No comments yet