CVE-2026-19904

1.9 lowEPSS 0.4%

Low (1.9). EPSS 0.4% chance of exploitation in the next 30 days.

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=site_settings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used.

Severity

CVSS 4.0

1.9 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

CVSS 3.1

2.4 low

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-94
Published: 2026-08-15
Modified: 2026-08-20
Record from: the NVD, synced 2026-10-19

References

https://medium.com/@hemantrajbhati5555/stored-cross-site-scripting-xss-in-system-settings-module-fa4f99ed1544
https://vuldb.com/cve/CVE-2026-19904
https://vuldb.com/submit/870786
https://vuldb.com/vuln/390097
https://vuldb.com/vuln/390097/cti

Check your stack JSON