CVE-2026-85187
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. The function Order::pupdate in the file /rider/orders/controller.php?action=edit&actions=confirm is affected by SQL injection via manipulation of the ID argument.
Risk Assessment
An attacker can remotely manipulate SQL queries, potentially leading to unauthorized data access, modification, or deletion.
Recommendation
Apply vendor patches or use parameterized queries to prevent SQL injection.
Other vulnerabilities in itsourcecode Online Medicine Delivery System
See all- CVE-2026-85208High
A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation is possible, and the exploit has been publicly released.
- CVE-2026-85205Medium
A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controller.php?action=addwish of the component Wishlist. This manipulation of the argument proid causes sql injection. The attack may be initiated remotely.
- CVE-2026-82615High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the Customer::find_phone function of /passwordrecover.php, part of the Password Recovery Interface. Manipulation of the phonenumber argument leads to SQL injection. Remote exploitation is possible, and the exploit has been disclosed.
- CVE-2026-82614High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the loadResultList function of /index.php?q=product, part of the Product Category Filter Interface. Manipulation of the Category argument leads to SQL injection. The attack may be launched remotely, and the exploit has been published.
- CVE-2026-82613High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the loadResultList function of /index.php?q=product, part of the Product Search Interface. Manipulation of the Search argument leads to SQL injection. The attack may be initiated remotely, and the exploit is now public.
- CVE-2026-82612High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the loadResultList function of /index.php?q=single-item, part of the Product Detail Page. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed publicly.
- CVE-2026-82611High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the Customer::cusAuthentication function of /login.php, part of the Customer Login Interface. Manipulation of the U_USERNAME argument causes SQL injection. The attack can be initiated remotely, and the exploit has been made public.
- CVE-2026-82610High
A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the Employee::employeeAuthentication function of /rider/login.php, part of the Login Interface. Manipulation of the emp_email argument results in SQL injection. The attack can be launched remotely, and the exploit has been released publicly.
Original NVD description (English source)
A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the file /rider/orders/controller.php?action=edit&actions=confirm of the component Order Status Update. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS