An SQL injection vulnerability (CVE-2026-10258) affects itsourcecode Content Management System 1.0. The vulnerability arises from improper sanitization of the topic_id parameter in the /admin/add_sub_topic.php file, allowing remote attackers with low privileges to manipulate SQL queries. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating it is exploitable over the network with low attack complexity and no user interaction required. Public exploit code is available, but no official fix or mitigation has been published by the vendor.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the requirement of low privileges and the vulnerability's low confidentiality, integrity, and availability impact metrics. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable functionality and monitor for suspicious activity related to the topic_id parameter. Avoid exposing the /admin/add_sub_topic.php endpoint to untrusted networks if possible.