{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-13504","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2026-06-27T18:29:41.908Z","datePublished":"2026-06-28T15:30:08.051Z","dateUpdated":"2026-06-30T17:59:08.512Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-06-28T15:30:08.051Z"},"title":"code-projects Project Management System Mail Compose mail.php cross site scripting","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-79","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"type":"CWE","cweId":"CWE-94","lang":"en","description":"Code Injection"}]}],"affected":[{"vendor":"code-projects","product":"Project Management System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:code-projects:project_management_system:*:*:*:*:*:*:*:*"],"modules":["Mail Compose Page"]}],"descriptions":[{"lang":"en","value":"A vulnerability has been found in code-projects Project Management System 1.0. This vulnerability affects unknown code of the file /mail.php of the component Mail Compose Page. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used."}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":3.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":3.5,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}],"timeline":[{"time":"2026-06-27T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-06-27T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-06-27T20:34:45.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"MyMy (VulDB User)","type":"reporter"}],"references":[{"url":"https://vuldb.com/vuln/374499","name":"VDB-374499 | code-projects Project Management System Mail Compose mail.php cross site scripting","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/374499/cti","name":"VDB-374499 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-13504","name":"CVE-2026-13504 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/838683","name":"Submit #838683 | code-projects Project Management System 1.0 Cross Site Scripting","tags":["third-party-advisory"]},{"url":"https://github.com/MyMySSS/CVE123/blob/main/cve4/PMS_CVE_Submission.md","tags":["exploit"]},{"url":"https://code-projects.org/","tags":["product"]}],"tags":["x_freeware"]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-30T17:58:59.827905Z","id":"CVE-2026-13504","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-06-30T17:59:08.512Z"}}]}}