The vulnerability CVE-2026-9527 affects itsourcecode Electronic Judging System 1.0 due to improper input validation of the 'fname' parameter in the /admin/judges.php endpoint. This flaw enables remote attackers to conduct cross-site scripting attacks by injecting malicious scripts that execute in the context of the victim's browser. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction needed, and low impact on integrity. No official patch or vendor remediation guidance is currently available.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected web application, potentially allowing attackers to steal session tokens, perform actions on behalf of users, or deliver malicious payloads. The impact is limited by the need for user interaction and the low integrity impact rating. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the 'fname' parameter in /admin/judges.php to mitigate XSS risks. Additionally, restricting access to the affected endpoint to trusted users may reduce exposure.