The vulnerability CVE-2026-10302 affects itsourcecode Fees Management System 1.0. It is caused by improper sanitization of the ID parameter in an unknown function within the /manage_fee.php file, allowing an attacker to perform SQL injection remotely. This could enable unauthorized access or modification of the database. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. No official fix or vendor advisory is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium based on the CVSS score, indicating limited but significant risk to confidentiality, integrity, and availability of the system data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or parameterized queries to the ID parameter in /manage_fee.php if possible. Monitor vendor channels for updates and apply patches promptly once available.