CVE-2026-9447
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
SQL Injection vulnerability in /user/search.php of SourceCodester Simple POS and Inventory System 1.0. Manipulation of Name argument leads to SQL injection. Remote attack, exploit public.
Risk Assessment
Risk of remote SQL injection, potentially leading to data leakage and database integrity compromise.
Recommendation
Immediately implement parameterized SQL queries for the Name argument in /user/search.php.
Other vulnerabilities in SourceCodester Simple POS and Inventory System
See all- CVE-2026-9446Medium
A vulnerability was found in SourceCodester Simple POS and Inventory System 1.0, where an unknown function in /admin/edit_customer.php is prone to SQL injection via the ID argument. The attack can be executed remotely, and the exploit is public.
- CVE-2026-9445Medium
A flaw in SourceCodester Simple POS and Inventory System 1.0 allows unrestricted file upload via the /admin/addproduct.php file. The image argument is not properly validated, enabling remote attackers to upload malicious files. An exploit has been published, increasing the risk of exploitation.
- CVE-2026-9444Medium
In SourceCodester Simple POS and Inventory System 1.0, the delete function in /admin/deleteproduct.php (GET Parameter Handler) is vulnerable to SQL injection via the ID argument. Remote attack is possible, and the exploit is public.
Original NVD description (English source)
A vulnerability was found in SourceCodester Simple POS and Inventory System 1.0. The impacted element is an unknown function of the file /user/search.php. Performing a manipulation of the argument Name results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.