CVE-2026-86294: Cross Site Scripting in SourceCodester Simple Traffic Offense System

This vulnerability in SourceCodester Simple Traffic Offense System 1.0 involves cross-site scripting via the manipulation of the site_name and site_desc arguments in the save-settings.php file of the Settings Update Endpoint. Remote attackers can exploit this flaw to inject malicious scripts, potentially affecting users who interact with the vulnerable functionality. The vulnerability is publicly known and has a CVSS 4.0 base score of 5.3, indicating a medium severity level. No vendor advisory or patch information is provided in the available data.

Successful exploitation of this XSS vulnerability could allow remote attackers to execute arbitrary scripts in the context of the affected web application. This may lead to session hijacking, defacement, or redirection to malicious sites. However, the impact is limited by the medium CVSS score and the requirement for user interaction (UI:P). There is no indication of privilege escalation or direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation and output encoding on the affected parameters (site_name and site_desc) to mitigate the risk. Monitoring for updates from SourceCodester is recommended.