CVE-2026-4835

Vulnerability

Description

A stored cross-site scripting (XSS) vulnerability has been identified in code-projects Accounting System 1.0. The flaw resides in the costumer_name parameter of the /my_account/add_costumer.php endpoint. The application does not sanitize or validate user-supplied input before storing it in the database and later rendering it in the web interface without proper output encoding [1].

Attack

Vector

An attacker can submit a malicious JavaScript payload in the costumer_name field when adding a new customer record. No special privileges or network position are required beyond the ability to access the web application interface remotely. The injected script persists in the database and executes automatically in the browser of any authenticated user who views the stored data [1].

Impact

Successful exploitation allows arbitrary JavaScript execution in the victim's browser context. This can lead to session hijacking, credential theft, or unauthorized actions on behalf of the authenticated user, such as modifying financial records or extracting sensitive data [1].

Mitigation

As of the publication date (2026-03-26), the vendor has not released a patch. Users should implement input validation and output encoding for the costumer_name parameter, apply Content Security Policy headers, and set HttpOnly and Secure flags on cookies to reduce risk [1].