CVE-2026-90597
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/sup_edit1.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Risk Assessment
SQL injection may allow an attacker to access, modify, or delete data, potentially resulting in a breach of information security.
Recommendation
Implement input validation and query parameterization, and consider updating to a more secure version if available.
Other vulnerabilities in Sales and Inventory System
See all- CVE-2026-90600Medium
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- CVE-2026-90525Medium
A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/cust_pos_trans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
- CVE-2026-86675Medium
A vulnerability in itsourcecode Sales and Inventory System 1.0 affects an unknown part of the file /pages/us_edit.php. Manipulation of the argument ID leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-86270Medium
SQL injection vulnerability in itsourcecode Sales and Inventory System 1.0, affecting an unknown function in /pages/settings_edit.php. Manipulating the ID argument leads to SQL injection. The attack may be performed remotely, and the exploit is public.
- CVE-2026-86236Medium
A vulnerability was found in itsourcecode Sales and Inventory System 1.0 in the file /pages/pro_transac.php?action=add. Manipulating the Name argument leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed.
- CVE-2026-86235Medium
A vulnerability was found in itsourcecode Sales and Inventory System 1.0 in the file /pages/pos_transac.php?action=add. Manipulating the Customer argument leads to SQL injection. The attack can be initiated remotely, and the exploit has been published.
- CVE-2026-86234Medium
A vulnerability was detected in itsourcecode Sales and Inventory System 1.0 in the file /pages/cust_transac.php?action=add. Manipulating the firstname argument results in SQL injection. The attack can be launched remotely, and the exploit is now public.
- CVE-2026-86233Medium
A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0 in the file /pages/us_del.php?type=user. Manipulating the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit has been disclosed publicly.
- CVE-2026-82696Medium
A SQL injection vulnerability was found in itsourcecode Sales and Inventory System 1.0 in /pages/inv_searchfrm.php. Manipulation of the ID argument allows remote SQL queries. The exploit is public.
- CVE-2026-82609Medium
A vulnerability was identified in itsourcecode Sales and Inventory System 1.0 in an unknown function of /pages/inv_edit.php. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/sup_edit1.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS