CVE-2026-5330

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5330", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-01T13:47:29.145Z", "datePublished": "2026-04-02T12:45:10.637Z", "dateUpdated": "2026-04-02T14:19:51.165Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-02T12:45:10.637Z"}, "title": "SourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "SourceCodester", "product": "Best Courier Management System", "versions": [{"version": "1.0", "status": "affected"}], "modules": ["User Delete Handler"]}, {"vendor": "mayuri_k", "product": "Best Courier Management System", "versions": [{"version": "1.0", "status": "affected"}], "modules": ["User Delete Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in SourceCodester/mayuri_k Best Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=delete_user of the component User Delete Handler. Performing a manipulation of the argument ID results in improper access controls. The attack may be initiated remotely. The exploit has been made public and could be used."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.4, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-01T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-01T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-01T15:52:37.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Zyyyy (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/354664", "name": "VDB-354664 | SourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354664/cti", "name": "VDB-354664 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780734", "name": "Submit #780734 | Mayuri K. Gaatitrack Courier Management System 1.0 Broken Access Control", "tags": ["third-party-advisory"]}, {"url": "https://github.com/zy606/Vulnerability-Report/tree/main/Gaatitrack-Unauth-Delete", "tags": ["exploit"]}], "tags": ["x_freeware"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T14:19:28.837594Z", "id": "CVE-2026-5330", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T14:19:51.165Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5330", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T14:19:28.837594Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T14:19:44.262Z"}}], "cna": {"tags": ["x_freeware"], "title": "SourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control", "credits": [{"lang": "en", "type": "reporter", "value": "Zyyyy (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.4, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "SourceCodester", "modules": ["User Delete Handler"], "product": "Best Courier Management System", "versions": [{"status": "affected", "version": "1.0"}]}, {"vendor": "mayuri_k", "modules": ["User Delete Handler"], "product": "Best Courier Management System", "versions": [{"status": "affected", "version": "1.0"}]}], "timeline": [{"lang": "en", "time": "2026-04-01T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-01T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-01T15:52:37.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/354664", "name": "VDB-354664 | SourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354664/cti", "name": "VDB-354664 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780734", "name": "Submit #780734 | Mayuri K. Gaatitrack Courier Management System 1.0 Broken Access Control", "tags": ["third-party-advisory"]}, {"url": "https://github.com/zy606/Vulnerability-Report/tree/main/Gaatitrack-Unauth-Delete", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in SourceCodester/mayuri_k Best Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=delete_user of the component User Delete Handler. Performing a manipulation of the argument ID results in improper access controls. The attack may be initiated remotely. The exploit has been made public and could be used."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-02T12:45:10.637Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5330", "state": "PUBLISHED", "dateUpdated": "2026-04-02T14:19:51.165Z", "dateReserved": "2026-04-01T13:47:29.145Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-02T12:45:10.637Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["User Delete Handler"], "product": "Best Courier Management System", "vendor": "SourceCodester", "versions": [{"status": "affected", "version": "1.0"}]}, {"modules": ["User Delete Handler"], "product": "Best Courier Management System", "vendor": "mayuri_k", "versions": [{"status": "affected", "version": "1.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in SourceCodester/mayuri_k Best Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=delete_user of the component User Delete Handler. Performing a manipulation of the argument ID results in improper access controls. The attack may be initiated remotely. The exploit has been made public and could be used."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en SourceCodester/mayuri_k Best Courier Management System 1.0. Afectada por este problema es alguna funcionalidad desconocida del archivo /ajax.PHP?action=delete_user del componente Gestor de Eliminaci\u00f3n de Usuarios. Realizar una manipulaci\u00f3n del argumento ID resulta en controles de acceso inadecuados. El ataque puede ser iniciado remotamente. El exploit ha sido hecho p\u00fablico y podr\u00eda ser usado."}], "id": "CVE-2026-5330", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.4, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5330", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-02T14:19:28.837594Z", "version": "2.0.3"}}]}, "published": "2026-04-02T13:16:27.633", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/zy606/Vulnerability-Report/tree/main/Gaatitrack-Unauth-Delete"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/780734"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354664"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354664/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-284"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Best Courier Management System", "source": "cna", "vendor": "mayuri_k"}, "product": "best_courier_management_system", "vendor": "mayuri_k"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 94.0, "source": "matching"}]}, "original": {"product": "Best Courier Management System", "source": "cna", "vendor": "SourceCodester"}, "product": "courier_management_system", "vendor": "sourcecodester"}], "analysis": {"en": {"generated_at": "2026-04-02T15:08:38.724404+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch or upgrade the system to a version that fixes the delete_user access control flaw.", "If a patch is not available immediately, restrict access to the /ajax.php?action=delete_user endpoint to administrative users only.", "Implement additional authentication checks before performing user deletions.", "Monitor application logs for unexpected delete_user requests and investigate anomalies."], "summary": {"action": "Patch immediately", "impact": "Unauthorized user deletion via improper access control"}, "threat_synthesis": {"affected_systems": "The affected product is the SourceCodester and mayuri_k Best Courier Management System version 1.0. All deployments that include the /ajax.php User Delete Handler are vulnerable until a patch is applied.", "description_and_impact": "The vulnerability resides in the file /ajax.php?action=delete_user of the Best Courier Management System. By manipulating the ID parameter, an attacker can bypass authorization checks and delete arbitrary user accounts. This results in loss of user data and integrity violations, and may facilitate further attacks by removing legitimate users. The weakness corresponds to improper authorization and access control.", "risk_and_exploitability": "The CVSS score of 6.9 indicates moderate severity, while EPSS data is not available and the vulnerability is not listed in the KEV catalog. The exploit can be carried out remotely by sending crafted HTTP requests to the delete endpoint, so the attack vector is likely network-based. The public exploit confirms that remote attackers can achieve unauthorized deletion without needing additional credentials."}}}}, "created": "2026-04-02T20:12:39.716215+00:00", "updated": "2026-04-02T20:21:19.871196+00:00", "vendors": ["mayuri_k", "mayuri_k$PRODUCT$best_courier_management_system", "sourcecodester", "sourcecodester$PRODUCT$courier_management_system"]}