CVE-2026-108966: SourceCodester Performance Indicator System product.php sql injection
A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of SourceCodester Performance Indicator System 1.0 are potentially exposed where the /opils/staff/product.php endpoint is reachable remotely. The affected processing is associated with the Category argument.
What does an attacker need to exploit it?
The vulnerability can be initiated remotely and has no stated privilege or user-interaction requirement. A public exploit is available, which may lower the effort needed for exploitation.
What is the likely impact of successful exploitation?
The provided severity vector indicates potential low impact to confidentiality, integrity, and availability. The issue is classified as SQL injection.
How can I determine whether my deployment is affected?
Verify whether the system is SourceCodester Performance Indicator System version 1.0 and whether /opils/staff/product.php processes a Category argument. The supplied data does not identify a narrower affected configuration or a fixed version.