CVE-2026-5561
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Campcodes Complete POS Management and Inventory System up to 4.0.6 has an injection vulnerability in SettingsController.php in the Environment Variable Handler component. Remote attack is possible and the exploit is public.
Risk Assessment
An attacker can inject malicious data into environment variables, potentially leading to arbitrary code execution or privilege escalation.
Recommendation
Update the system to a version above 4.0.6 or apply available patches.
Original NVD description (English source)
A vulnerability was determined in Campcodes Complete POS Management and Inventory System up to 4.0.6. This affects an unknown function of the file app/Http/Controllers/SettingsController.php of the component Environment Variable Handler. Executing a manipulation can lead to injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.