CVE-2026-100887
MediumCVSS 6.3Summary
A SQL injection vulnerability was found in Mini-Inventory-and-Sales-Management-System in the order_by function. Manipulating the orderBy argument allows remote attack. The exploit is public. The project is no longer maintained.
Risk Assessment
An attacker can remotely manipulate the database, potentially leading to data leakage or modification. Lack of support increases risk as no patches are available.
Recommendation
Due to lack of support, immediately stop using this system and migrate to an actively maintained solution. If necessary, restrict access to the application.
Other vulnerabilities in Mini-Inventory-and-Sales-Management-System
See all- CVE-2026-100904Low
A cross-site scripting (XSS) vulnerability was found in mini-inventory-and-sales-management-system in the Items.php file. Manipulating the itemName argument allows remote attack. The exploit is publicly available.
- CVE-2026-76785Medium
A security flaw has been discovered in Mini-Inventory-and-Sales-Management-System 0.1. The function Transaction::getAll in application/models/Transaction.php is affected. Manipulation of the orderBy/orderFormat arguments results in SQL injection, and the attack can be initiated remotely. The exploit has been publicly released.
Original NVD description (English source)
A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function order_by of the file DB_query_builder.php of the component Database Query Builder. Performing a manipulation of the argument orderBy results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project maintainer confirms: "I stopped maintaining that project for a while now, so I'm not sure it's worth fixing." This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS