CVE Intelligence
Analysis AI-assisted

CVE-2026-1594: itsourcecode Society Management System 1.0 SQL Injection in add_expenses.php

A SQL injection vulnerability has been reported in the add_expenses.php component of itsourcecode Society Management System 1.0, reachable through the detail argument. The record describes remote exploitation and a publicly disclosed exploit, but CISA KEV does not list it and no confirmed active exploitation appears in the sources consulted. The record provides no vendor patch or fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a SQL injection flaw in the file /admin/add_expenses.php of itsourcecode Society Management System 1.0. The manipulated argument is detail. The entry is classified under CWE-74 (Injection).

Impact

The NVD vector indicates a network-reachable attack that requires no privileges or user interaction, with high impact on confidentiality, integrity and availability. This is an inference from the vector string and the 9.8 critical score, not a separate assessment.

Affected products and versions

  • The record lists version 1.0 as affected.
  • The affected field names the product Angeljudesuarez Society Management System, while the description refers to itsourcecode Society Management System. The record does not reconcile these names.
  • Other versions are not listed, so their status is unknown.

Exploitation status

  • The description states that an exploit has been publicly disclosed and may be used. A GitHub issue referenced by the record carries an Exploit tag.
  • The record shows the CVE is not listed in CISA KEV. No confirmed active exploitation appears in the sources consulted.

Remediation and mitigation

  • The record contains no vendor patch or fixed version. The only fix-related reference is a mitigation-type link to a third-party GitHub issue.
  • Until an official correction is confirmed, restrict access to administrative pages, review how the application handles database input with its developers, and check the vendor site for updates.
  • Prioritize this component for review because of the critical score and the public exploit disclosure.

Detection guidance

  • Review web server and application logs for requests to the add_expenses.php endpoint with unusual or malformed values in the detail parameter.
  • Monitor database error messages that may indicate injection attempts.
  • Inventory deployments of this software, including copies obtained from unofficial sources.

Limitations of the available information

  • No EPSS or SSVC data is present in the record.
  • VulDB provides CVSS 4.0 and 2.0 scores with different values. The record includes only the NVD 3.1 score.
  • The vendor identity and the full affected version range are not reconciled.
  • Fixed versions are unknown.

Frequently asked questions

Is CVE-2026-1594 known to be actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The description does state that a public exploit exists and may be used.

Is there an official fix for this vulnerability?

The record does not list a vendor patch or fixed version. The only fix-related reference is a mitigation link to a third-party GitHub issue.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.