The vulnerability CVE-2026-10253 affects itsourcecode Online House Rental System 1.0. It involves an SQL injection issue in the /manage_payment.php file triggered by manipulation of the ID parameter. The vulnerability allows remote attackers to inject SQL commands due to insufficient input validation or sanitization. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official fix or patch has been published, and the exploit code is publicly available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access, modification, or deletion depending on the database privileges. The impact is rated medium based on the CVSS score and vector, with limited but non-negligible confidentiality, integrity, and availability consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or filtering on the ID parameter in /manage_payment.php to mitigate injection risks. Monitoring for unusual database queries or access patterns may help detect exploitation attempts. Avoid exposing the vulnerable endpoint publicly if possible.