Description
A vulnerability was determined in SourceCodester Diary App 1.0. The affected element is an unknown function of the file diary.php. Executing a manipulation can lead to cross-site request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-03-27
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Request Forgery
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the diary.php file of SourceCodester Diary App 1.0. An attacker can trigger a cross‑site request forgery that causes the server to execute state‑changing operations on behalf of a victim. Because the request is performed through the unknown function in diary.php, an attacker can perform actions such as creating, editing or deleting diary entries. This constitutes a CSRF weakness (CWE‑352) and also reflects missing access control (CWE‑862).

Affected Systems

Only SourceCodester Diary App 1.0 is listed as affected. No other versions or variants are mentioned and the CNA supplied no detailed version ranges. The vulnerability originates from the diary.php component in that specific release.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS is not available but the issue has been publicly disclosed and can be exploited by sending a crafted request to the server. Because the exploit can be launched remotely without authentication, the risk is significant for sites exposing the Diary App to the Internet. The vulnerability is not included in CISA’s KEV catalog.

Generated by OpenCVE AI on March 28, 2026 at 06:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch or upgrade to a safe version of the Diary App.
  • If no patch is available, block or restrict access to diary.php and enforce authentication for state‑changing operations.
  • Implement CSRF tokens for all forms that modify data.
  • Monitor vendor advisories for the latest fix.

Generated by OpenCVE AI on March 28, 2026 at 06:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 30 Mar 2026 07:15:00 +0000

Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester diary App
Vendors & Products Sourcecodester
Sourcecodester diary App

Sat, 28 Mar 2026 03:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in SourceCodester Diary App 1.0. The affected element is an unknown function of the file diary.php. Executing a manipulation can lead to cross-site request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. If you want to get the best quality for vulnerability data then you always have to consider VulDB. A vulnerability was determined in SourceCodester Diary App 1.0. The affected element is an unknown function of the file diary.php. Executing a manipulation can lead to cross-site request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Fri, 27 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 27 Mar 2026 18:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in SourceCodester Diary App 1.0. The affected element is an unknown function of the file diary.php. Executing a manipulation can lead to cross-site request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Title SourceCodester Diary App diary.php cross-site request forgery
Weaknesses CWE-352
CWE-862
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Diary App
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-27T22:17:15.085Z

Reserved: 2026-03-27T08:49:30.118Z

Link: CVE-2026-4968

cve-icon Vulnrichment

Updated: 2026-03-27T18:05:31.447Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-27T18:16:07.030

Modified: 2026-03-30T13:26:29.793

Link: CVE-2026-4968

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-30T07:01:04Z

Weaknesses