CVE-2026-86164
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A SQL injection vulnerability was found in itsourcecode Sales and Inventory System 1.0 in the file /pages/trans_view.php. Manipulating the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly released.
Risk Assessment
An attacker could gain unauthorized access to transactional data, potentially leading to information leakage or data manipulation.
Recommendation
Apply patches and implement parameterized SQL queries and input validation.
Other vulnerabilities in itsourcecode Sales and Inventory System
See all- CVE-2026-86517Medium
A flaw in itsourcecode Sales and Inventory System 1.0 affects the mysqli_query function in /pages/us_searchfrm.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been published.
- CVE-2026-86310Medium
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_edit1.php. Manipulation of the argument ID leads to SQL injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
- CVE-2026-86309Medium
A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_searchfrm.php. Manipulation of the argument ID causes SQL injection. The attack can be initiated remotely. The exploit has been published and may be used.
- CVE-2026-86291Medium
In itsourcecode Sales and Inventory System 1.0, a vulnerability was detected in the file /pages/us_edit1.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed publicly.
- CVE-2026-86269Medium
A vulnerability was found in itsourcecode Sales and Inventory System 1.0, specifically in the file /pages/emp_edit1.php. Manipulation of the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been published.
- CVE-2026-86265Medium
A vulnerability was found in itsourcecode Sales and Inventory System 1.0, in the file /pages/us_transac.php. Manipulation of the Username argument leads to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-86245Medium
A vulnerability was detected in itsourcecode Sales and Inventory System 1.0, in the file /pages/sup_transac.php. Manipulation of the companyname argument results in SQL injection. The attack can be initiated remotely, and the exploit is now public.
- CVE-2026-86232Medium
Vulnerability in itsourcecode Sales and Inventory System 1.0. An unknown functionality in /pages/sup_del.php?type=supplier is vulnerable to SQL injection via the ID argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-86163Medium
A SQL injection vulnerability was found in itsourcecode Sales and Inventory System 1.0 in the file /pages/pro_del.php. Manipulating the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-85383Medium
A flaw has been found in itsourcecode Sales and Inventory System 1.0 in the file /pages/inv_del.php. Manipulation of the argument ID leads to SQL injection. The attack can be executed remotely. The exploit is public.
Original NVD description (English source)
A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/trans_view.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.