CVE-2026-10295 Details
Description
A vulnerability was found in SourceCodester Customer Review App 1.0. Affected by this vulnerability is the function add_review/save_review/get_all_reviews of the file review_app.py. Performing a manipulation of the argument name/comment results in denial of service. The attack requires a local approach. The exploit has been made public and could be used.
A denial-of-service vulnerability has been identified in SourceCodester Customer Review App version 1.0. The issue arises in the file review_app.py, specifically within the functions add_review, save_review, and get_all_reviews. The vulnerability is caused by improper input validation, allowing a local attacker to manipulate the name and comment fields. This exploitation can lead to excessive disk space usage or corruption of the reviews data, causing the application to lag, freeze, or silently lose all review information without any user notification.
To address this vulnerability, input length validation should be implemented to restrict the size of the name and comment fields. Additionally, the application should replace the bare except clause in the get_all_reviews function with specific exception handling to avoid silently suppressing errors.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 1, 2026CISA-ADP
Assessed Jun 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://pastebin.com/Ud5vaGp6 | [email protected] | ExploitTechnical Description |
| https://vuldb.com/cve/CVE-2026-10295 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/826530 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/367588 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/367588/cti | [email protected] | AdvisoryPermission Required |
| https://www.sourcecodester.com/ | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SourceCodester Customer Review App | 1.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | New CVE Received | [email protected] |