CVE-2026-86292CWE-287CWE-306

CVE-2026-86292

High · published September 7, 2026

CVSS v3.1
7.3
EPSS
1%
Percentile
52.1
In the wild
Unconfirmed
What it is

A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php of the component User Creation. Performing a manipulation of the argument position results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00686 · 52.1th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2026-09-07T14:16Z
References (6)
https://github.com/tan1540684326-QAQ/cve/issues/1 · [email protected]https://vuldb.com/cve/CVE-2026-86292 · [email protected]https://vuldb.com/submit/906272 · [email protected]https://vuldb.com/vuln/399454 · [email protected]https://vuldb.com/vuln/399454/cti · [email protected]https://www.sourcecodester.com/ · [email protected]
EPSS history
Timeline
  • 09 SEP 03:20Z
    EPSS moved — → 1%
    epss
  • 07 SEP 09:30Z
    SourceCodester Simple Traffic Offense System User Creation saveuser.php missing authentication
    cvelistv5