CVE-2026-86294 identifies a cross-site scripting vulnerability in SourceCodester Simple Traffic Offense System 1.0. The issue is located in the save-settings.php file's Settings Update Endpoint, where manipulation of the site_name or site_desc arguments can lead to XSS. This vulnerability allows remote attackers to execute scripts in the context of the affected application, potentially impacting integrity but not confidentiality or availability. The CVSS 3.1 base score is 4.3 (low), reflecting network attack vector, low complexity, no privileges required, user interaction needed, and limited impact on integrity only.

The vulnerability allows remote attackers to perform cross-site scripting attacks by injecting malicious scripts via the site_name or site_desc parameters. This can lead to limited integrity impact such as script execution in the victim's browser context. There is no impact on confidentiality or availability. Exploitation requires user interaction. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint or sanitizing inputs at the application level to mitigate XSS risks. Monitor vendor channels for updates or patches addressing this vulnerability.