CVE-2026-108965: SourceCodester Performance Indicator System edit_quantity.php sql injection
A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/editquantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of SourceCodester Performance Indicator System 1.0 are in scope when the /opils/staff/edit_quantity.php endpoint is remotely reachable. The vulnerable input is the pqty argument.
What does an attacker need to exploit it?
The attack can be launched remotely and requires manipulation of the pqty argument sent to /opils/staff/edit_quantity.php. No privileges or user interaction are indicated by the supplied vector.
How urgent is remediation?
The issue is rated high with a 7.3 score, and public exploit disclosure is reported. This increases the likelihood that attackers may attempt exploitation against reachable installations.