CVE-2026-82614
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the loadResultList function of /index.php?q=product, part of the Product Category Filter Interface. Manipulation of the Category argument leads to SQL injection. The attack may be launched remotely, and the exploit has been published.
Risk Assessment
A remote attacker could exploit this vulnerability to gain unauthorized access to the database, steal data, or modify data, compromising system security.
Recommendation
Apply vendor patches or implement input validation and parameterized queries. Also monitor logs for suspicious queries.
Other vulnerabilities in itsourcecode Online Medicine Delivery System
See all- CVE-2026-85208High
A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation is possible, and the exploit has been publicly released.
- CVE-2026-85205Medium
A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controller.php?action=addwish of the component Wishlist. This manipulation of the argument proid causes sql injection. The attack may be initiated remotely.
- CVE-2026-85187High
A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. The function Order::pupdate in the file /rider/orders/controller.php?action=edit&actions=confirm is affected by SQL injection via manipulation of the ID argument.
- CVE-2026-82615High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the Customer::find_phone function of /passwordrecover.php, part of the Password Recovery Interface. Manipulation of the phonenumber argument leads to SQL injection. Remote exploitation is possible, and the exploit has been disclosed.
- CVE-2026-82613High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the loadResultList function of /index.php?q=product, part of the Product Search Interface. Manipulation of the Search argument leads to SQL injection. The attack may be initiated remotely, and the exploit is now public.
- CVE-2026-82612High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the loadResultList function of /index.php?q=single-item, part of the Product Detail Page. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed publicly.
- CVE-2026-82611High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the Customer::cusAuthentication function of /login.php, part of the Customer Login Interface. Manipulation of the U_USERNAME argument causes SQL injection. The attack can be initiated remotely, and the exploit has been made public.
- CVE-2026-82610High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the Employee::employeeAuthentication function of /rider/login.php, part of the Login Interface. Manipulation of the emp_email argument results in SQL injection. The attack can be launched remotely, and the exploit has been released publicly.
Original NVD description (English source)
A flaw has been found in itsourcecode Online Medicine Delivery System 1.0. This vulnerability affects the function loadResultList of the file /index.php?q=product of the component Product Category Filter Interface. Executing a manipulation of the argument Category can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS