CVE-2026-6035

Vulnerability

Overview

A cross-site scripting (XSS) vulnerability exists in the code-projects Vehicle Showroom Management System version 1.0. The flaw is located in the /BranchManagement/ServiceAndSalesReport.php file, where the BRANCH_ID parameter is processed. The root cause is that user-supplied input is directly output to the web page without proper sanitization or encoding, allowing an attacker to inject arbitrary HTML or malicious script code [1].

Exploitation

Details

Exploitation is possible remotely and does not require authentication or any special privileges [1]. An attacker can craft a malicious payload, such as `, and submit it via the BRANCH_ID` parameter. When the page is rendered, the injected script executes in the context of the victim's browser session [1].

Impact

Successful exploitation enables an attacker to steal cookies, session tokens, or other sensitive information, perform actions on behalf of the victim, deface web pages, redirect users to malicious sites, or potentially gain control over the victim's browser. This poses a serious threat to user privacy and system security [1].

Mitigation

As of the publication date, no official patch has been released by the vendor. The project is available reference confirms the vulnerability has been publicly disclosed [1]. Users should apply input validation and output encoding for the BRANCH_ID parameter, or consider migrating to a maintained alternative if the project remains unpatched.