Itsourcecode · Fleet Management System · CVE-2026-10296
**Name of the Vulnerable Software and Affected Versions**
itsourcecode Fees Management System version 1.0
**Description**
A remote SQL injection exists in the `/ajax.php` endpoint. This issue occurs when the `Username` argument is manipulated, allowing an attacker to execute arbitrary SQL commands.
**Recommendations**
Update itsourcecode Fees Management System version 1.0 to a patched version. As a temporary workaround, restrict access to the `/ajax.php` endpoint or sanitize the `Username` parameter to prevent malicious input.