CVE-2026-82612
HighCVSS 7.3Summary
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the loadResultList function of /index.php?q=single-item, part of the Product Detail Page. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed publicly.
Risk Assessment
A remote attacker could exploit this vulnerability to gain unauthorized access to the database, steal data, or modify data, compromising system security.
Recommendation
Apply vendor patches or implement input validation and parameterized queries. Also monitor logs for suspicious queries.
Other vulnerabilities in itsourcecode Online Medicine Delivery System
See all- CVE-2026-82615High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the Customer::find_phone function of /passwordrecover.php, part of the Password Recovery Interface. Manipulation of the phonenumber argument leads to SQL injection. Remote exploitation is possible, and the exploit has been disclosed.
- CVE-2026-82614High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the loadResultList function of /index.php?q=product, part of the Product Category Filter Interface. Manipulation of the Category argument leads to SQL injection. The attack may be launched remotely, and the exploit has been published.
- CVE-2026-82613High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the loadResultList function of /index.php?q=product, part of the Product Search Interface. Manipulation of the Search argument leads to SQL injection. The attack may be initiated remotely, and the exploit is now public.
- CVE-2026-82611High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the Customer::cusAuthentication function of /login.php, part of the Customer Login Interface. Manipulation of the U_USERNAME argument causes SQL injection. The attack can be initiated remotely, and the exploit has been made public.
- CVE-2026-82610High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the Employee::employeeAuthentication function of /rider/login.php, part of the Login Interface. Manipulation of the emp_email argument results in SQL injection. The attack can be launched remotely, and the exploit has been released publicly.
Original NVD description (English source)
A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function loadResultList of the file /index.php?q=single-item of the component Product Detail Page. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.