PT-2026-29325 · Oretnom23 · Alton Management System

Meifukun · CVE-2026-30521 · Published 2026-03-31 · Updated 2026-07-24

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Loan Management System version 1.0

Description A business logic issue exists due to improper server-side validation. The application allows administrators to create loan plans with specific interest rates. Although the frontend prevents the entry of negative numbers, this constraint is not enforced on the backend. An authenticated attacker can bypass client-side restrictions by manipulating the HTTP POST request to submit a negative value for the interest percentage variable, leading to the creation of loan plans with negative interest rates.

Recommendations Update SourceCodester Loan Management System version 1.0 to a version that implements proper server-side validation for the interest percentage variable.

Exploit

Fix

Weakness Enumeration

CWE-602

Related Identifiers

CVE-2026-30521

Affected Products

Alton Management System

References · 3

• 🔥 https://github.com/meifukun/Web-Security-PoCs/blob/main/Loan-Management-System/BusinessLogic-LoanPlan-NegativeInterest.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30521 · Security Note
• https://t.me/cveNotify/221407 · Telegram Post