CVE-2026-10155
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Vulnerability in Bdtask Multi-Store Inventory Management System 1.0 allows SQL Injection by manipulating the dtpToDate argument in the accounts_report_search function of the file application/modules/accounts/controllers/Accounts.php.
Risk Assessment
An attacker can remotely execute arbitrary SQL queries, potentially leading to data leakage, database modification, or privilege escalation.
Recommendation
Immediately upgrade the system to the latest version or use parameterized SQL queries and input validation.
Other vulnerabilities in Bdtask Multi-Store Inventory Management System
See all- CVE-2026-10172Medium
Vulnerability in Bdtask Multi-Store Inventory Management System 1.0 allows unrestricted file upload by manipulating the module argument in the Upload function of the file application/modules/dashboard/controllers/Module.php.
- CVE-2020-36012Medium
A stored XSS vulnerability was found in BDTASK Multi-Store Inventory Management System 1.0. A local admin can inject arbitrary JavaScript code via the Customer Name field.
Original NVD description (English source)
A vulnerability was found in Bdtask Multi-Store Inventory Management System 1.0. The impacted element is the function accounts_report_search of the file application/modules/accounts/controllers/Accounts.php of the component Accounts Report Handler. Performing a manipulation of the argument dtpToDate results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.