CVE-2026-108967
HighCVSS 7.3Summary
SourceCodester Performance Indicator System 1.0 contains a SQL injection vulnerability in the file /opils/staff/edit_credit.php. Manipulation of the credit argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly released.
Risk Assessment
An attacker could exploit SQL injection to gain unauthorized access to the database, potentially leading to data exfiltration, modification, or deletion. The publicly available exploit increases the risk of attack.
Recommendation
Immediately update or secure SourceCodester Performance Indicator System. Also, review and secure SQL queries in edit_credit.php by using parameterization.
Other vulnerabilities in SourceCodester Performance Indicator System
See all- CVE-2026-108968High
SourceCodester Performance Indicator System 1.0 contains a SQL injection vulnerability in the file /opils/staff/sales_history.php. Manipulation of the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly released.
- CVE-2026-108966High
A SQL injection vulnerability was identified in SourceCodester Performance Indicator System 1.0 in the file /opils/staff/product.php. Manipulation of the Category argument allows remote attack. The exploit is publicly available.
- CVE-2026-108965High
A SQL injection vulnerability was found in SourceCodester Performance Indicator System 1.0 in the file /opils/staff/edit_quantity.php. Manipulation of the pqty argument allows remote attack. The exploit has been publicly disclosed.
- CVE-2026-108964High
A SQL injection vulnerability was identified in SourceCodester Performance Indicator System 1.0 in the file /opils/admin/addproduct.php. Manipulation of the prodcategory argument allows remote attack. The exploit has been made public.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/edit_credit.php. The manipulation of the argument credit results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS