CVE-2026-108968
HighCVSS 7.3Summary
SourceCodester Performance Indicator System 1.0 contains a SQL injection vulnerability in the file /opils/staff/sales_history.php. Manipulation of the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly released.
Risk Assessment
An attacker could exploit SQL injection to gain unauthorized access to the database, potentially leading to data exfiltration, modification, or deletion. The publicly available exploit increases the risk of attack.
Recommendation
Immediately update or secure SourceCodester Performance Indicator System. Also, review and secure SQL queries in sales_history.php by using parameterization.
Other vulnerabilities in SourceCodester Performance Indicator System
See all- CVE-2026-108967High
SourceCodester Performance Indicator System 1.0 contains a SQL injection vulnerability in the file /opils/staff/edit_credit.php. Manipulation of the credit argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly released.
- CVE-2026-108966High
A SQL injection vulnerability was identified in SourceCodester Performance Indicator System 1.0 in the file /opils/staff/product.php. Manipulation of the Category argument allows remote attack. The exploit is publicly available.
- CVE-2026-108965High
A SQL injection vulnerability was found in SourceCodester Performance Indicator System 1.0 in the file /opils/staff/edit_quantity.php. Manipulation of the pqty argument allows remote attack. The exploit has been publicly disclosed.
- CVE-2026-108964High
A SQL injection vulnerability was identified in SourceCodester Performance Indicator System 1.0 in the file /opils/admin/addproduct.php. Manipulation of the prodcategory argument allows remote attack. The exploit has been made public.
Original NVD description (English source)
A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS