CVE-2026-91854— code-projects Record Management System reg.php cross site scripting
Quick assessment
Affected
code-projects Record Management System
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 code-projects 记录管理系统 1.0 中发现了一个漏洞。该漏洞位于文件 main/reg.php 中的一个未知函数。对参数 desc 的操控可导致跨站脚本（XSS）攻击。该攻击可远程发起，且利用工具已公开，可能被用于实际攻击。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-91854
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
code-projects Record Management System reg.php cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was identified in code-projects Record Management System 1.0. Affected is an unknown function of the file main/reg.php. Such manipulation of the argument desc leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| code-projects | Record Management System | 1.0 |
cpe:2.3:a:code-projects:record_management_system:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-91854
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-91854
请登录查看更多情报信息。
Proof of Concept for CVE-2026-91854 (1)
IV. Related Vulnerabilities
Same product: Record Management System
-
CVE-2026-5576
SourceCodester/jkev Record Management System Add Employee sa -
CVE-2026-5575
SourceCodester/jkev Record Management System Login index.php -
CVE-2024-9810
SourceCodester Record Management System sort2_user.php cross -
CVE-2024-8137
SourceCodester Record Management System search_user.php cros -
CVE-2024-8136
SourceCodester Record Management System sort1_user.php cross
Same vendor: code-projects
-
CVE-2026-86519
code-projects Student Crud Operation Backup File card_activa -
CVE-2026-86518
code-projects Student Crud Operation edit.php sql injection -
CVE-2026-86302
code-projects Hospital Information System SQL Database Backu -
CVE-2026-86301
code-projects Hospital Information System Patient Management -
CVE-2026-86217
code-projects Hotel and Tourism Reservation in PHP Database
Same weakness: CWE-79
-
CVE-2026-68534
Concrete CMS below 9.5.2 is vulnerable to Stored XSS via une -
CVE-2026-81899
Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via gr -
CVE-2026-18113
Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the -
CVE-2026-81898
Concrete CMS below version 9.5.3 is vulnerable to Stored XS -
CVE-2026-12749
Multiple security vulnerabilities are addressed with IBM Clo
V. Comments for CVE-2026-91854
No comments yet