Security readout for executives and security teams
Plain-English summary
CVE-2026-1134 is a cross-site scripting issue in itsourcecode Society Management System 1.0. An attacker can manipulate the “detail” field in /admin/expenses.php to run script in a user’s browser. Business risk is mainly account misuse, data exposure through the browser, or unauthorized actions if an administrator is tricked into interacting.
Executive priority
Treat as a near-term remediation item if this application is internet-accessible or used by administrators. It is not a critical infrastructure-wide emergency based on available evidence, but public exploit availability increases urgency for exposed deployments.
Technical view
The vulnerability affects an unknown function in /admin/expenses.php and is triggered through the detail argument. CVSS 4.0 score is 5.3, with network attack vector, low complexity, no privileges required, and user interaction required. The record maps to CWE-79 and CWE-94, but the described issue is cross-site scripting.
Likely exposure
Exposure is limited to organizations running itsourcecode Society Management System version 1.0. Risk is higher if the admin expenses page is reachable from untrusted networks or used by privileged staff. The sources do not identify other affected versions or products.
Exploitation context
The CVE record states the attack may be initiated remotely and that a public exploit is available. CISA KEV status is false in the provided data, and no cited source confirms active exploitation. User interaction is required according to the CVSS vector.
Researcher notes
Evidence is mainly from VulDB/CVE metadata and a public GitHub issue reference. The vulnerable function is not identified, and no official patch is named in the sources. Avoid assuming broader version impact beyond Society Management System 1.0.
Mitigation direction
- Check itsourcecode or project guidance for an official fix or updated release.
- Restrict access to administrative Society Management System pages to trusted users and networks.
- Validate and safely encode user-controlled expense detail data before display.
- Review application code handling the detail parameter in /admin/expenses.php.
- Consider a web application firewall rule while awaiting vendor guidance.
Validation and detection
- Inventory systems for itsourcecode Society Management System version 1.0.
- Confirm whether /admin/expenses.php is deployed and reachable.
- Review logs for unusual requests involving the detail parameter.
- Test safely in a controlled environment for improper script rendering.
- Verify any remediation by confirming user input is encoded on output.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1134 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- VDB-341724 | itsourcecode Society Management System expenses.php cross site scriptingCVE reference · vdb-entry, technical-description
- VDB-341724 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #735156 | itsourcecode Society Management System V1.0 cross site scriptingCVE reference · third-party-advisory
- https://github.com/TEhS411/cve/issues/7CVE reference · exploit, issue-tracking
- https://itsourcecode.com/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.