CVE-2026-108965
HighCVSS 7.3Summary
A SQL injection vulnerability was found in SourceCodester Performance Indicator System 1.0 in the file /opils/staff/edit_quantity.php. Manipulation of the pqty argument allows remote attack. The exploit has been publicly disclosed.
Risk Assessment
An attacker could manipulate SQL queries, potentially leading to unauthorized data access or modification, and privilege escalation.
Recommendation
Apply vendor patches and use parameterized queries in edit_quantity.php.
Other vulnerabilities in SourceCodester Performance Indicator System
See all- CVE-2026-108968High
SourceCodester Performance Indicator System 1.0 contains a SQL injection vulnerability in the file /opils/staff/sales_history.php. Manipulation of the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly released.
- CVE-2026-108967High
SourceCodester Performance Indicator System 1.0 contains a SQL injection vulnerability in the file /opils/staff/edit_credit.php. Manipulation of the credit argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly released.
- CVE-2026-108966High
A SQL injection vulnerability was identified in SourceCodester Performance Indicator System 1.0 in the file /opils/staff/product.php. Manipulation of the Category argument allows remote attack. The exploit is publicly available.
- CVE-2026-108964High
A SQL injection vulnerability was identified in SourceCodester Performance Indicator System 1.0 in the file /opils/admin/addproduct.php. Manipulation of the prodcategory argument allows remote attack. The exploit has been made public.
Original NVD description (English source)
A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS