CVE-2026-108965: SourceCodester Performance Indicator System edit_quantity.php sql injection

Published Oct 13, 2026

Updated

A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/editquantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Affected Software

1 affected component

Sourcecodester Performance Indicator System=1.0

Event History

Oct 13, 2026

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments of SourceCodester Performance Indicator System 1.0 are in scope when the /opils/staff/edit_quantity.php endpoint is remotely reachable. The vulnerable input is the pqty argument.

What does an attacker need to exploit it?

The attack can be launched remotely and requires manipulation of the pqty argument sent to /opils/staff/edit_quantity.php. No privileges or user interaction are indicated by the supplied vector.

How urgent is remediation?

The issue is rated high with a 7.3 score, and public exploit disclosure is reported. This increases the likelihood that attackers may attempt exploitation against reachable installations.

CVE-2026-108965: SourceCodester Performance Indicator System edit_quantity.php sql injection

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How urgent is remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How urgent is remediation?