CVE-2026-86245
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability was detected in itsourcecode Sales and Inventory System 1.0, in the file /pages/sup_transac.php. Manipulation of the companyname argument results in SQL injection. The attack can be initiated remotely, and the exploit is now public.
Risk Assessment
An attacker may gain unauthorized access to supplier or transaction data. Remote attack increases the risk.
Recommendation
Update the system or apply patches. Also, check logs for suspicious activities.
Other vulnerabilities in itsourcecode Sales and Inventory System
See all- CVE-2026-86517Medium
A flaw in itsourcecode Sales and Inventory System 1.0 affects the mysqli_query function in /pages/us_searchfrm.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been published.
- CVE-2026-86310Medium
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_edit1.php. Manipulation of the argument ID leads to SQL injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
- CVE-2026-86309Medium
A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_searchfrm.php. Manipulation of the argument ID causes SQL injection. The attack can be initiated remotely. The exploit has been published and may be used.
- CVE-2026-86291Medium
In itsourcecode Sales and Inventory System 1.0, a vulnerability was detected in the file /pages/us_edit1.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed publicly.
- CVE-2026-86269Medium
A vulnerability was found in itsourcecode Sales and Inventory System 1.0, specifically in the file /pages/emp_edit1.php. Manipulation of the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been published.
- CVE-2026-86265Medium
A vulnerability was found in itsourcecode Sales and Inventory System 1.0, in the file /pages/us_transac.php. Manipulation of the Username argument leads to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-86232Medium
Vulnerability in itsourcecode Sales and Inventory System 1.0. An unknown functionality in /pages/sup_del.php?type=supplier is vulnerable to SQL injection via the ID argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-86164Medium
A SQL injection vulnerability was found in itsourcecode Sales and Inventory System 1.0 in the file /pages/trans_view.php. Manipulating the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly released.
- CVE-2026-86163Medium
A SQL injection vulnerability was found in itsourcecode Sales and Inventory System 1.0 in the file /pages/pro_del.php. Manipulating the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-85383Medium
A flaw has been found in itsourcecode Sales and Inventory System 1.0 in the file /pages/inv_del.php. Manipulation of the argument ID leads to SQL injection. The attack can be executed remotely. The exploit is public.
Original NVD description (English source)
A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_transac.php. Performing a manipulation of the argument companyname results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.