CVE-2026-76785
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A security flaw has been discovered in Mini-Inventory-and-Sales-Management-System 0.1. The function Transaction::getAll in application/models/Transaction.php is affected. Manipulation of the orderBy/orderFormat arguments results in SQL injection, and the attack can be initiated remotely. The exploit has been publicly released.
Risk Assessment
An attacker can remotely manipulate SQL queries, potentially leading to unauthorized data access, modification, or deletion. The project has not responded, so the risk remains unpatched.
Recommendation
Apply a patch immediately or temporarily disable the affected functionality if possible. Also validate and sanitize user input for the orderBy and orderFormat arguments.
Other vulnerabilities in Mini-Inventory-and-Sales-Management-System
See all- CVE-2026-100904Low
A cross-site scripting (XSS) vulnerability was found in mini-inventory-and-sales-management-system in the Items.php file. Manipulating the itemName argument allows remote attack. The exploit is publicly available.
- CVE-2026-100887Medium
A SQL injection vulnerability was found in Mini-Inventory-and-Sales-Management-System in the order_by function. Manipulating the orderBy argument allows remote attack. The exploit is public. The project is no longer maintained.
Original NVD description (English source)
A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file application/models/Transaction.php. Performing a manipulation of the argument orderBy/orderFormat results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS