Security readout for executives and security teams
Plain-English summary
CVE-2026-0586 is a medium-severity cross-site scripting issue in code-projects Online Product Reservation System 1.0. A crafted value in the cat parameter of handgunner-administrator/prod.php can affect a user who interacts with it. Public exploit details exist, but the provided sources do not show confirmed active exploitation.
Executive priority
Treat as a timely web application fix if this product is deployed, especially on public sites. The business risk is user/session manipulation rather than server takeover based on supplied data. Prioritize inventory, exposure reduction, and vendor or code-level remediation.
Technical view
The issue is reported as CWE-79 affecting an unknown function in handgunner-administrator/prod.php. Remote attackers can manipulate the cat argument to cause XSS. CVSS 4.0 is 5.3 with network attack vector, low complexity, no privileges required, and user interaction required. Integrity impact is limited per the supplied vector.
Likely exposure
Exposure is most likely where code-projects Online Product Reservation System 1.0 is deployed and the administrator prod.php path is reachable by users or the internet. Organizations using modified copies of this PHP project should also review derived code paths.
Exploitation context
A public proof-of-concept reference is listed, so opportunistic testing is plausible. The CVE is not listed as KEV in the supplied bundle, and no cited source confirms active exploitation in the wild. User interaction is required according to the CVSS vector.
Researcher notes
Evidence is limited to public CVE/VulDB/GitHub references. The affected function is not identified. No official patch is named in the supplied sources. Avoid assuming broader versions or products are affected without confirming code reuse or vendor statements.
Mitigation direction
- Check code-projects or maintainer guidance for an official fix or replacement.
- Restrict access to handgunner-administrator/prod.php where business operations allow.
- Sanitize and output-encode the cat parameter before rendering it in HTML.
- Review derived or customized copies for the same input-handling pattern.
- Deploy web application controls to reduce reflected script execution risk.
Validation and detection
- Inventory deployments of Online Product Reservation System 1.0 and forks.
- Confirm whether handgunner-administrator/prod.php is externally reachable.
- Review prod.php handling of the cat parameter for output encoding.
- Check application logs for unusual cat parameter values.
- Retest after remediation using safe, non-destructive XSS validation methods.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-0586 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- VDB-339478 | code-projects Online Product Reservation System prod.php cross site scriptingCVE reference · vdb-entry, technical-description
- VDB-339478 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #731098 | code-projects Online Product Reservation system in PHP with source code V1.0 Improper Neutralization of Alternate XSS SyntaxCVE reference · third-party-advisory
- https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/xss_prod.php.mdCVE reference · related, exploit
- https://code-projects.org/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.