Log in Start free

Vulnerability · Published Apr 2, 2026 · Assigned by VulDB

CVE-2026-5330SourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control

Medium 6.5

In plain English

A medium-severity improper access control in Best Courier Management System from mayuri_k. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 75.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in SourceCodester/mayuri_k Best Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=delete_user of the component User Delete Handler. Performing a manipulation of the argument ID results in improper access controls. The attack may be initiated remotely. The exploit has been made public and could be used.

Affected products (as reported)

VendorProductVersions
SourceCodester Best Courier Management System 1.0
mayuri_k Best Courier Management System 1.0

Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

References