CVE-2026-82421
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability was identified in itsourcecode Sales and Inventory System 1.0, affecting the file /pages/emp_edit.php. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit is publicly available.
Risk Assessment
The risk for the organization includes remote compromise of the database, data theft or modification, and potential privilege escalation within the system.
Recommendation
It is recommended to apply patches or updates immediately, and to validate and sanitize input in emp_edit.php to prevent SQL injection.
Other vulnerabilities in itsourcecode Sales and Inventory System
See all- CVE-2026-90700Medium
A vulnerability was detected in an unknown function of /pages/pro_edit1.php in itsourcecode Sales and Inventory System 1.0. Manipulation of the prodcode argument leads to SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed.
- CVE-2026-90574Medium
A SQL injection vulnerability was discovered in itsourcecode Sales and Inventory System 1.0 in an unknown function of /pages/emp_transac.php?action=add. Manipulation of the firstname argument leads to SQL injection. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-86517Medium
A flaw in itsourcecode Sales and Inventory System 1.0 affects the mysqli_query function in /pages/us_searchfrm.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been published.
- CVE-2026-86310Medium
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_edit1.php. Manipulation of the argument ID leads to SQL injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
- CVE-2026-86309Medium
A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_searchfrm.php. Manipulation of the argument ID causes SQL injection. The attack can be initiated remotely. The exploit has been published and may be used.
- CVE-2026-86291Medium
In itsourcecode Sales and Inventory System 1.0, a vulnerability was detected in the file /pages/us_edit1.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed publicly.
- CVE-2026-86269Medium
A vulnerability was found in itsourcecode Sales and Inventory System 1.0, specifically in the file /pages/emp_edit1.php. Manipulation of the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been published.
- CVE-2026-86265Medium
A vulnerability was found in itsourcecode Sales and Inventory System 1.0, in the file /pages/us_transac.php. Manipulation of the Username argument leads to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-86245Medium
A vulnerability was detected in itsourcecode Sales and Inventory System 1.0, in the file /pages/sup_transac.php. Manipulation of the companyname argument results in SQL injection. The attack can be initiated remotely, and the exploit is now public.
- CVE-2026-86232Medium
Vulnerability in itsourcecode Sales and Inventory System 1.0. An unknown functionality in /pages/sup_del.php?type=supplier is vulnerable to SQL injection via the ID argument. The attack can be performed remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/emp_edit.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS