CVE-2026-30521

MediumCVSS 6.5/10Last modified Jul 24, 2026

Description

A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application allows administrators to create "Loan Plans" with specific interest rates. While the frontend interface prevents users from entering negative numbers, this constraint is not enforced on the backend. An authenticated attacker can bypass the client-side restriction by manipulating the HTTP POST request to submit a negative value for the interest_percentage. This results in the creation of loan plans with negative interest rates.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-602

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Mar 31, 2026
Last modified
Jul 24, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-305226.5A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application CVE-2026-305236.5A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to the lack of proper input validation. The applicatCVE-2026-305266.1A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Zoo Management System v1.0. The vulnerability is located in thCVE-2026-305275.4A Stored Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Category management modulCVE-2026-305298.8A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_user CVE-2026-30539.8A vulnerability was determined in DataLinkDC dinky up to 1.2.5. This affects the function addInterceptors of the file dinky-admin/src/main/jCVE-2026-305309.8A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_custoCVE-2026-305318.8A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_categCVE-2026-305329.8A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/view_product.php file via the "id" paraCVE-2026-305339.8A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/manage_product.php file via the "id" paCVE-2026-305348.3A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in admin/manage_category.php via the "id" parameter.CVE-2026-30546.1A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads t
CVE-2026-30521: Medium severity, CVSS 6.5 | Vulnix