CVE-2026-7612

11th percentile - higher than 11% of all known CVEs

A vulnerability was determined in itsourcecode Courier Management System 1.0 in an unknown function of the file /edit_user.php. Manipulation of the argument ID can lead to SQL injection, and the attack may be performed remotely. The exploit has been publicly disclosed and may be utilized.

A remote attacker could exploit the SQL injection for unauthorized database access or modification. The public availability of the exploit increases the risk of exploitation.

Update the software to a patched version or apply the vendor's workaround. Until then restrict access to /edit_user.php and use input validation and WAF rules.