CVE-2026-85383
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A flaw has been found in itsourcecode Sales and Inventory System 1.0 in the file /pages/inv_del.php. Manipulation of the argument ID leads to SQL injection. The attack can be executed remotely. The exploit is public.
Risk Assessment
The risk includes potential remote SQL injection, which could lead to unauthorized database access, data leakage, or data modification.
Recommendation
It is recommended to immediately validate and sanitize input in inv_del.php and use parameterized queries. Also, consider updating the system.
Other vulnerabilities in itsourcecode Sales and Inventory System
See all- CVE-2026-86517Medium
A flaw in itsourcecode Sales and Inventory System 1.0 affects the mysqli_query function in /pages/us_searchfrm.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been published.
- CVE-2026-86310Medium
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_edit1.php. Manipulation of the argument ID leads to SQL injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
- CVE-2026-86309Medium
A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_searchfrm.php. Manipulation of the argument ID causes SQL injection. The attack can be initiated remotely. The exploit has been published and may be used.
- CVE-2026-86291Medium
In itsourcecode Sales and Inventory System 1.0, a vulnerability was detected in the file /pages/us_edit1.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed publicly.
- CVE-2026-86269Medium
A vulnerability was found in itsourcecode Sales and Inventory System 1.0, specifically in the file /pages/emp_edit1.php. Manipulation of the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been published.
- CVE-2026-86265Medium
A vulnerability was found in itsourcecode Sales and Inventory System 1.0, in the file /pages/us_transac.php. Manipulation of the Username argument leads to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-86245Medium
A vulnerability was detected in itsourcecode Sales and Inventory System 1.0, in the file /pages/sup_transac.php. Manipulation of the companyname argument results in SQL injection. The attack can be initiated remotely, and the exploit is now public.
- CVE-2026-86232Medium
Vulnerability in itsourcecode Sales and Inventory System 1.0. An unknown functionality in /pages/sup_del.php?type=supplier is vulnerable to SQL injection via the ID argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-86164Medium
A SQL injection vulnerability was found in itsourcecode Sales and Inventory System 1.0 in the file /pages/trans_view.php. Manipulating the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly released.
- CVE-2026-86163Medium
A SQL injection vulnerability was found in itsourcecode Sales and Inventory System 1.0 in the file /pages/pro_del.php. Manipulating the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
Original NVD description (English source)
A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_del.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.