The vulnerability CVE-2026-10568 affects itsourcecode Fees Management System version 1.0. It is caused by improper sanitization of the ID parameter in the /manage_payment.php file, leading to SQL injection. This allows an attacker to inject malicious SQL queries remotely, potentially compromising the database. The CVSS 4.0 base score is 5.3 (medium), indicating a moderate risk. No official fix or vendor advisory is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion. The vulnerability requires low attack complexity and no user interaction, but privileges required are low (PR:L). The overall impact is limited to the confidentiality, integrity, and availability of the database managed by the Fees Management System.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected endpoint, applying web application firewall (WAF) rules to detect and block SQL injection attempts, and reviewing application input validation and sanitization practices.