CVE-2026-90795 Details

A cross-site scripting (XSS) vulnerability has been identified in the Itsourccecode Loan Management System version 1.0. The issue arises in the 'navbar.php' file, where user input from the 'page' parameter is not properly sanitized before being reflected in the output. This flaw allows remote attackers to inject and execute arbitrary JavaScript in the context of the user's browser session. The vulnerability has been publicly disclosed and could be exploited by tricking a user into clicking a malicious link.

To address this vulnerability, implement input validation to reject special characters and adopt an allow-list approach. Additionally, ensure proper output encoding using functions like htmlspecialchars() or htmlentities(), and consider adding security headers such as Content-Security-Policy and X-XSS-Protection.