CVE-2026-82611
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the Customer::cusAuthentication function of /login.php, part of the Customer Login Interface. Manipulation of the U_USERNAME argument causes SQL injection. The attack can be initiated remotely, and the exploit has been made public.
Risk Assessment
A remote attacker could exploit this vulnerability to perform unauthorized logins, access user accounts, or steal data, compromising system security.
Recommendation
Apply vendor patches or implement input validation and parameterized queries. Also monitor login logs for suspicious attempts.
Other vulnerabilities in itsourcecode Online Medicine Delivery System
See all- CVE-2026-85208High
A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation is possible, and the exploit has been publicly released.
- CVE-2026-85205Medium
A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controller.php?action=addwish of the component Wishlist. This manipulation of the argument proid causes sql injection. The attack may be initiated remotely.
- CVE-2026-85187High
A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. The function Order::pupdate in the file /rider/orders/controller.php?action=edit&actions=confirm is affected by SQL injection via manipulation of the ID argument.
- CVE-2026-82615High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the Customer::find_phone function of /passwordrecover.php, part of the Password Recovery Interface. Manipulation of the phonenumber argument leads to SQL injection. Remote exploitation is possible, and the exploit has been disclosed.
- CVE-2026-82614High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the loadResultList function of /index.php?q=product, part of the Product Category Filter Interface. Manipulation of the Category argument leads to SQL injection. The attack may be launched remotely, and the exploit has been published.
- CVE-2026-82613High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the loadResultList function of /index.php?q=product, part of the Product Search Interface. Manipulation of the Search argument leads to SQL injection. The attack may be initiated remotely, and the exploit is now public.
- CVE-2026-82612High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the loadResultList function of /index.php?q=single-item, part of the Product Detail Page. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed publicly.
- CVE-2026-82610High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the Employee::employeeAuthentication function of /rider/login.php, part of the Login Interface. Manipulation of the emp_email argument results in SQL injection. The attack can be launched remotely, and the exploit has been released publicly.
Original NVD description (English source)
A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication of the file /login.php of the component Customer Login Interface. This manipulation of the argument U_USERNAME causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS