Medium severity · published Jan 19, 2026
CVE-2026-1135
itsourcecode Society Management System activity.php cross site scripting
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
A security flaw has been discovered in itsourcecode Society Management System 1.0. This impacts an unknown function of the file /admin/activity.php. The manipulation of the argument Title results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Society Management System · itsourcecode
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1135
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1135
Exploit
https://github.com/TEhS411/cve/issues/8
Product
https://itsourcecode.com/
Permissions Required
https://vuldb.com/?ctiid.341725
Third Party Advisory
https://vuldb.com/?id.341725
Third Party Advisory
https://vuldb.com/?submit.735157
More from Society Management System
9.8
CVE-2026-3410
itsourcecode Society Management System check_studid.php sql injection
9.8
CVE-2026-2117
itsourcecode Society Management System edit_activity.php sql injection
9.8
CVE-2026-2116
itsourcecode Society Management System edit_expenses.php sql injection
9.8
CVE-2026-2115
itsourcecode Society Management System delete_expenses.php sql injection
9.8
CVE-2026-2114
itsourcecode Society Management System edit_admin.php sql injection