CVE-2026-78656
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_del.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
Risk Assessment
SQL injection can allow an attacker to access the database, steal, modify, or delete data, potentially leading to serious security breaches.
Recommendation
Apply patches or restrict access to the system, and use parameterized queries to prevent SQL injection.
Other vulnerabilities in itsourcecode Sales and Inventory System
See all- CVE-2026-82422Medium
In itsourcecode Sales and Inventory System 1.0, a SQL injection vulnerability exists in the file /pages/emp_del.php via manipulation of the ID argument. The attack may be launched remotely, and the exploit has been released to the public.
- CVE-2026-82421Medium
A vulnerability was identified in itsourcecode Sales and Inventory System 1.0, affecting the file /pages/emp_edit.php. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit is publicly available.
- CVE-2026-78171High
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0 in an unknown functionality of the file /pages/processlogin.php. Manipulation of the User argument leads to SQL injection. The attack can be initiated remotely and the exploit has been disclosed publicly.
Original NVD description (English source)
A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_del.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.