CVE-2026-2009

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/php_action/createUser.php. Executing a manipulation can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been published and may be used.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-266CWE-284

Affected software

VendorProductVersions
SourceCodesterGas Agency Management System1.0

References

Timeline

Published
Feb 6, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-200904.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileCVE-2026-200914.8A vulnerability in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, reCVE-2026-200926.0A vulnerability in the read-only maintenance shell of Cisco Intersight Virtual Appliance could allow an authenticated, local attacker with aCVE-2026-200939.8A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote CVE-2026-200948.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with read-only privileges tCVE-2026-200956.5A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privilegesCVE-2026-200966.5A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privilegesCVE-2026-200976.5A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privilegesCVE-2026-200988.8A vulnerability in the Certificate Management feature of Cisco Meeting Management could allow an authenticated, remote attacker to upload arCVE-2026-200996.7A vulnerability in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticateCVE-2026-20104.2A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publCVE-2026-201007.7A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Softw
CVE-2026-2009: Medium severity, CVSS 6.5 | Vulnix