CVE-2026-91854: Record Management System 1.0 XSS Vulnerability

CVE-2026-91854 Overview

CVE-2026-91854 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in code-projects Record Management System 1.0. The flaw resides in the main/reg.php script, where the desc parameter is rendered without proper sanitization or output encoding. An unauthenticated remote attacker can inject arbitrary JavaScript that executes in the browser of any user who later views the affected record.

The issue has been publicly disclosed, and proof-of-concept details are available in third-party research repositories. Exploitation requires user interaction, and impact is limited to integrity of the rendered content.

Critical Impact
Stored XSS in main/reg.php allows remote attackers to inject persistent scripts through the desc argument, enabling session abuse and browser-context attacks against subsequent viewers.

Affected Products

code-projects Record Management System 1.0
Deployments exposing main/reg.php to untrusted input
Applications reusing the vulnerable registration code path

Discovery Timeline

2026-09-15 - CVE-2026-91854 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91854

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the registration handler main/reg.php. The desc parameter accepted from user input is persisted to the backend datastore and later rendered into HTML responses without contextual output encoding. Any HTML or script content supplied by an attacker is served back verbatim to subsequent viewers.

Because the payload persists in application storage, exploitation is asynchronous. An attacker submits a crafted desc value once, and every user who loads the affected page triggers the injected script. The attack requires no authentication, but a victim must load the affected view for the script to fire.

Typical outcomes include session token theft through document.cookie access, coerced actions against the vulnerable application via forged requests, credential harvesting through injected forms, and redirection to attacker-controlled infrastructure. The stored nature of the flaw makes it useful for targeting administrators who review submitted records.

Root Cause

The root cause is missing input validation and missing output encoding on the desc parameter processed by main/reg.php. The application trusts client-supplied content and inserts it directly into HTML contexts, violating the standard rule of contextual escaping for untrusted data. See the GitHub Stored XSS Documentation for reproduction detail.

Attack Vector

Exploitation is network-based and unauthenticated. An attacker submits a POST or GET request to main/reg.php containing a script payload in the desc field. The server stores the payload, and it executes in the browser of the next user who renders the record. Additional references are cataloged in the VulDB CVE-2026-91854 Entry.

No verified exploit code is being reproduced here. Refer to the VulDB Vulnerability #404085 entry for public technical notes.

Detection Methods for CVE-2026-91854

Indicators of Compromise

HTTP requests to main/reg.php containing HTML tags, <script> elements, or JavaScript event handlers in the desc parameter.
Database rows in the records table storing values with angle brackets, javascript: URIs, or encoded script fragments.
Outbound browser requests from internal users to unknown domains immediately after loading record pages.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST and GET bodies to main/reg.php for script signatures in the desc field.
Enable server-side request logging with full parameter capture, and alert on payloads containing <script, onerror=, onload=, or javascript:.
Baseline the character set of stored desc values and flag entries that deviate from expected alphanumeric content.

Monitoring Recommendations

Forward web server access logs and application logs to a centralized analytics platform for retrospective hunting.
Monitor administrator sessions for anomalous outbound requests after viewing user-submitted records.
Track new record submissions from IP addresses with prior reputation hits or bulk submission behavior.

How to Mitigate CVE-2026-91854

Immediate Actions Required

Restrict public access to main/reg.php behind authentication or IP allow-listing until a patched build is deployed.
Audit stored records for existing script payloads and purge or sanitize identified entries.
Enforce a strict Content Security Policy (CSP) that blocks inline script execution on pages rendering user-submitted data.

Patch Information

No vendor patch is referenced in the CVE record at time of publication. Consult the Code Projects Overview site for vendor updates, and track the VulDB CTI for Vulnerability #404085 entry for remediation status.

Workarounds

Apply server-side input validation on desc to reject HTML metacharacters, or HTML-encode the value on output using htmlspecialchars($value, ENT_QUOTES, 'UTF-8').
Deploy WAF signatures that block requests to main/reg.php containing script tags or JavaScript event handler patterns.
Set HttpOnly and Secure attributes on session cookies to limit the impact of successful script execution.

bash

# Example CSP header to reduce XSS impact on affected pages
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "DENY"