CVE-2026-6034

Vulnerability

Overview

A reflected cross-site scripting (XSS) vulnerability has been identified in code-projects Vehicle Showroom Management System version 1.0. The flaw resides in the /BranchManagement/ProfitAndLossReport.php file, where the BRANCH_ID parameter is` parameter is processed. The root cause is the application's failure to properly validate user input and encode output before rendering it on the web page, allowing an attacker to inject arbitrary HTML or JavaScript code [1].

Attack

Vector

The vulnerability can be exploited remotely without any authentication or prior authorization. An attacker crafts a malicious URL containing a payload in the BRANCH_ID parameter, such as ``. When a victim visits this crafted URL, the injected script executes in the context of the victim's browser session [1].

Impact

Successful exploitation enables an attacker to perform a range of malicious actions, including stealing cookies, session tokens, or other sensitive information, performing actions on behalf of the victim, defacing web pages, redirecting users to malicious sites, or gaining control over the victim's browser. This poses a serious threat to user privacy and system security [1].

Mitigation

As of the publication date, no official patch has been released by the vendor. The project is available for download from code-projects.org [2]. Users are advised to apply input sanitization and output encoding for the BRANCH_ID parameter, or to restrict access to the vulnerable script until a fix is provided.