CVE-2026-16229

MediumCVSS 4.3/10Last modified Oct 24, 2026

Description

A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Jul 19, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-16236.3A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This mCVE-2026-162309.8The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the deleteCVE-2026-162318.1hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helpCVE-2026-162329.8An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an CVE-2026-162337.8There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code exeCVE-2026-162347.8There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code exeCVE-2026-162359.8Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, whCVE-2026-162368.8The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due toCVE-2026-162388.8Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user ruCVE-2026-162398.8Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the dataCVE-2026-16248.8A security vulnerability has been detected in D-Link DWR-M961 1.1.47. The affected element is an unknown function of the file /boafrm/formLtCVE-2026-162413.8Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client v
CVE-2026-16229: Medium severity, CVSS 4.3 | Vulnix