CVE-2026-19925
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability was detected in SourceCodester Stock Management System 1.0 in the file /classes/Master.php?f=delete_supplier. Manipulating the ID argument results in SQL injection. The attack can be launched remotely, and the exploit is public.
Risk Assessment
Risk of unauthorized access to the database, potentially leading to data theft, modification, or deletion. The organization may face severe legal and operational consequences.
Recommendation
It is recommended to apply vendor patches immediately or implement input validation mechanisms to prevent SQL injection.
Other vulnerabilities in SourceCodester Stock Management System
See all- CVE-2026-78060Medium
A vulnerability was found in SourceCodester Stock Management System 1.0. The file /php_action/getOrderReport.php is vulnerable to cross-site scripting via manipulation of clientName/clientContact arguments. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-78059Medium
A vulnerability has been found in SourceCodester Stock Management System 1.0. The file /php_action/printOrder.php is vulnerable to cross-site scripting via manipulation of clientName/clientContact arguments. The attack may be performed remotely and the exploit has been disclosed publicly.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=delete_supplier. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS