s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

CVE-2026-9606

📛 CVE Title

itsourcecode Courier Management System manage_user.php sql injection

⬇ Download JSON ⚠ View as Threat

Description

A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

Overview

State
PUBLISHED
Assigner (CNA)
VulDB
CVSS severity
MEDIUM
CVSS score
CVSS 6.9 / 10 6.9 6.9 / 10
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Effective score
6.9 / 10 MEDIUM source: CNA overview
CWE(s)
CWE-89, CWE-74
Reserved
2026-05-26
Published
2026-05-26 23:30 UTC
Last updated
2026-05-27 12:33 UTC
Source
https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9606.json
Linked Threat
CVE-2026-9606 — CVE-2026-9606

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published
2026-05-27 00:16:39 UTC
NVD last modified
2026-06-17 11:05:32 UTC
NVD CVSS v3.1
CVSS 7.3 / 10 7.3 7.3 / 10 HIGH source: cna@vuldb.com
NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Exploitability subscore
3.9 / 10
Impact subscore
3.4 / 10
EPSS score
0.0025 (probability of exploitation in next 30 days)
EPSS percentile
16.70% vs all CVEs — higher = more likely to be exploited, as of 2026-07-01

NVD / KEV / EPSS data refreshed 2026-07-02 01:03 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID
EUVD-2026-32024
Assigner
VulDB
Published
May 26, 2026, 11:30:11 PM
Updated
May 27, 2026, 12:33:01 PM
EUVD base score (CVSS 4.0)
6.9 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EUVD-reported EPSS
0.2500
Vendors
itsourcecode
Products
Courier Management System (1.0)
Aliases
GHSA-2972-cgfm-mxj8

ENISA description: A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

EUVD references (5)

Affected products (1)
VendorProductVersionsPlatforms
itsourcecode Courier Management System 1.0 (affected) —

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

Web references (8)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

NVD-tagged references (5)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

Remediations (18)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

  • Microsoft and Adobe Patch Tuesday, May 2026 Security Update Review
    web:blog.qualys.com

    May 2026's Patch Tuesday arrives with Microsoft addressing a fresh set of vulnerabilities across its ecosystem, reinforcing the ongoing need for timely patching in an increasingly threat-heavy…

    2026-06-04 00:00 UTC
  • Microsoft Patch Tuesday May 2026 - 120 Vulnerabilities Fixed, Including ...
    web:cybersecuritynews.com

    Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.

    2026-06-04 00:00 UTC
  • Microsoft's May 2026 Patch Tuesday - Hive Pro
    web:hivepro.com

    Microsoft Patch Tuesday Overview and Vulnerability Distribution Microsoft's May 2026 Patch Tuesday delivers a comprehensive security update addressing 137 Microsoft vulnerabilities across the product ecosystem.

    2026-06-04 00:00 UTC
  • Security Update Guide - Microsoft
    web:portal.msrc.microsoft.com

    The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

    2026-06-04 00:00 UTC
  • Microsoft May 2026 Patch Tuesday Fixes 120 Flaws
    web:thecyberexpress.com

    Microsoft has rolled out its May 2026 Patch Tuesday security updates, delivering fixes for approximately 120 vulnerabilities across Windows, Microsoft Office, networking services, and enterprise platforms.

    2026-06-04 00:00 UTC
  • Critical Patches Issued for Microsoft Products, April 14, 2026
    web:www.cisecurity.org

    <p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...

    2026-06-04 00:00 UTC
  • Microsoft May 2026 Patch Tuesday: Many fixes, but no zero-days
    web:www.helpnetsecurity.com

    Microsoft has marked May 2026 Patch Tuesday by releasing fixes for 120+ CVE -numbered vulnerabilities, none of which are actively exploited.

    2026-06-04 00:00 UTC
  • Microsoft Patch Tuesday - May 2026 - Lansweeper
    web:www.lansweeper.com

    Which vulnerabilities, issues, and other things did Microsoft update? Discover what's new using Lansweeper's Patch Tuesday May 2026 summary.

    2026-06-04 00:00 UTC
  • Oracle Critical Patch Update Advisory - April 2026
    web:www.oracle.com

    This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

    2026-06-04 00:00 UTC
  • Patch Tuesday June 2026: Security Updates & CVE Analysis
    web:zecurit.com

    Get the complete breakdown of Microsoft's June 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

    2026-06-04 00:00 UTC
  • Microsoft Patch Tuesday June 2026 Fixes 206 Flaws
    web:cybersecurefox.com

    The June 2026 Patch Tuesday was record-breaking in scope: Microsoft addressed 206 vulnerabilities in its products, 39 of which were rated Critical and 167 Important. Among the fixes are three publicly disclosed zero-day vulnerabilities ( CVE - 2026 -50507, CVE - 2026 -49160, CVE - 2026 -45586) and three critical remote code execution issues with a maximum CVSS score of 9.8 that require neither ...

    2026-06-19 02:26 UTC
  • Microsoft June 2026 Patch Tuesday fixes 206 flaws, including CVE-2026 ...
    web:cybersixt.com

    Microsoft released its June 2026 Patch Tuesday updates, addressing 206 security vulnerabilities across Windows and related software, of which three were publicly disclosed zero‑day flaws, including an HTTP/2 bomb vulnerability ( CVE - 2026 -49160). The patches are now available for installation; administrators are advised to apply them promptly to mitigate potential exploitation.

    2026-06-19 02:26 UTC
  • Microsoft June 2026 Patch Tuesday Fixes 206 Flaws and 3 Zero-Days
    web:hackread.com

    Microsoft's June 2026 patch Tuesday resolves 206 vulnerabilities, including 3 critical zero-days and severe 9.8 CVSS kernel, network and HTTP.sys flaws.

    2026-06-19 02:26 UTC
  • Security Update Guide - Microsoft Security Response Center
    web:msrc.microsoft.com

    Security Update Guide - Microsoft Security Response Center

    2026-06-19 02:26 UTC
  • Microsoft June 2026 Patch Tuesday - securereading.com
    web:securereading.com

    Executive Summary Microsoft's Largest Security Update Raises Enterprise Security Urgency Microsoft has released its largest Patch Tuesday update to date, addressing 206 security vulnerabilities across Windows, Microsoft services, enterprise applications, and core infrastructure components. Among the patched vulnerabilities are three publicly disclosed zero-days, dozens of critical remote ...

    2026-06-19 02:26 UTC
  • June 2026 Patch Tuesday Fixes 200 Microsoft Vulnerabilities
    web:thecyberexpress.com

    June 2026 Patch Tuesday fixes 200 Microsoft vulnerabilities, including 3 zero-days and 33 critical flaws. Key risks and mitigation steps.

    2026-06-19 02:26 UTC
  • Microsoft Patches Record 206 Flaws and Zero-Days
    web:vulert.com

    That helps teams move from vulnerability awareness to fast remediation . Key Takeaways Microsoft's June 2026 Patch Tuesday fixed a record number of vulnerabilities, with counts varying by methodology up to 206 flaws. The release includes three publicly disclosed zero-days and multiple critical remote code execution vulnerabilities.

    2026-06-19 02:26 UTC
  • Critical Patches Issued for Microsoft Products, June 9, 2026
    web:www.cisecurity.org

    <p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...

    2026-06-19 02:26 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-9606.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9606",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T12:32:54.026616Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T12:33:01.449Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:itsourcecode:courier_management_system:*:*:*:*:*:*:*:*"
          ],
          "product": "Courier Management System",
          "vendor": "itsourcecode",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "zzl08 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T23:30:11.592Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-365679 | itsourcecode Courier Management System manage_user.php sql injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/365679"
        },
        {
          "name": "VDB-365679 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/365679/cti"
        },
        {
          "name": "Submit #818198 | itsourcecode Courier Management System 1.0 SQL Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/818198"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://lhzzz08.github.io/posts/cveapplication3/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://itsourcecode.com/"
        }
      ],
      "tags": [
        "x_freeware"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-26T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-05-26T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-05-26T18:21:28.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "itsourcecode Courier Management System manage_user.php sql injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-9606",
    "datePublished": "2026-05-26T23:30:11.592Z",
    "dateReserved": "2026-05-26T16:16:23.449Z",
    "dateUpdated": "2026-05-27T12:33:01.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}