SEPTEMBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-16229

MEDIUM · CVSS 4.3 EPSS 0.27% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-19 · Last synced 2026-08-18

CyberRota Analysis

AI-Generated

A cross-site scripting vulnerability exists in the Courier Management System up to version 1.0, specifically in the manipulation of the 'page' argument within the /index.php file. This flaw allows remote attackers to execute arbitrary scripts in the context of the user's browser, potentially leading to session hijacking or data theft. Organizations using this system should prioritize patching or implementing mitigations to safeguard against potential exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit
GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-16229
Severity
MEDIUM
CVSS
4.3
EPSS
0.27%

Original NVD Description

A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.