The vulnerability CVE-2026-10251 affects itsourcecode Online House Rental System 1.0. It involves an SQL injection flaw in the /ajax.php?action=login endpoint, specifically through the Username argument. This allows an unauthenticated remote attacker to inject SQL commands, potentially compromising the backend database. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official fix or patch has been documented in the vendor advisory or other sources.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely without authentication. This may lead to unauthorized data access, modification, or deletion depending on the database privileges. The impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the /ajax.php?action=login endpoint. Additionally, reviewing and hardening input validation and parameter sanitization in the affected application code is recommended. Monitor vendor channels for updates or patches.