The vulnerability CVE-2026-10568 affects itsourcecode Fees Management System 1.0. It is caused by improper sanitization of the ID argument in the /manage_payment.php file, leading to SQL injection. This allows an attacker to inject malicious SQL queries remotely, potentially compromising the backend database. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is published and exploit code is publicly available, but no official fix or patch has been disclosed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database of the Fees Management System. This may lead to unauthorized data access, modification, or deletion. The medium CVSS score reflects moderate impact with some limitations due to low privileges and partial confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying compensating controls such as input validation, web application firewalls, or restricting access to the vulnerable endpoint. Monitor vendor channels for updates and patches.