CVE-2026-10258

MediumCVSS 6.3/10Last modified Jul 22, 2026

Description

A weakness has been identified in itsourcecode Content Management System 1.0. Impacted is an unknown function of the file /admin/add_sub_topic.php. This manipulation of the argument topic_id causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Content Management System	1.0

References

Timeline

Published: Jun 1, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1025804.3A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component CVE-2026-1025815.4A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS CVE-2026-1025824.3A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, al CVE-2026-1025832.7A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web servic CVE-2026-1025844.3A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade pe CVE-2026-1025854.3A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the CVE-2026-1025866.1A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cro CVE-2026-1025872.7A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user wit CVE-2026-1025886.5A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an aut CVE-2026-1025897.1When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by th CVE-2026-102598.8A security vulnerability has been detected in H3C Magic B0 up to 100R002. The affected element is the function SetMobileAPInfoById of the fi CVE-2026-1025907.7IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side reque