CVE-2026-6035

CVE-2026-6035 is a cross-site scripting (XSS) vulnerability in code-projects Vehicle Showroom Management System version 1.0, specifically within the ServiceAndSalesReport.php file where the BRANCH_ID parameter is inadequately sanitized. This allows unauthenticated remote attackers to inject malicious scripts through a manipulated argument. The vulnerability affects the integrity of the application and can compromise user sessions or data. The vulnerability has a CVSS v3.1 severity score of 4.3 (Medium), with a network-based attack vector requiring minimal complexity and user interaction to trigger. The attack does not require authentication or elevated privileges, though successful exploitation depends on user action. The impact is limited to integrity violations with no confidentiality or availability compromise. Exploitation is currently limited in scope. While the vulnerability details have been publicly disclosed, the EPSS score of 0.00035 indicates an extremely low probability of active exploitation in the wild, and the CVE is not listed on the Known Exploited Vulnerabilities catalog or tracked as part of security community hotlists. Organizations running this software should still apply available patches, but this is not an imminent threat requiring emergency remediation.