CVE-2026-1135

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in itsourcecode Society Management System 1.0. This impacts an unknown function of the file /admin/activity.php. The manipulation of the argument Title results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
itsourcecode	Society Management System	1.0

References

https://github.com/TEhS411/cve/issues/8Exploit, Issue Tracking, Mitigation, Third Party Advisory
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.341725Permissions Required, VDB Entry
https://vuldb.com/?id.341725Third Party Advisory, VDB Entry
https://vuldb.com/?submit.735157Third Party Advisory, VDB Entry

Timeline

Published: Jan 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1135007.5The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can dele CVE-2026-1135013.1The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce i CVE-2026-1135046.5Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for ex CVE-2026-1135054.3A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download CVE-2026-1135069.9A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of CVE-2026-1135075.3A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The CVE-2026-1135087.5Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignor CVE-2026-113515.3The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing u CVE-2026-1135119.1Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree CVE-2026-1135127.8After Effects is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the CVE-2026-1135145.5After Effects is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could levera CVE-2026-1135167.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curren