CVE-2026-114250: itsourcecode Sales-and-Inventory-System cust_edit.php sql injection
A flaw has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. This issue affects some unknown processing of the file /pages/custedit.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attack can be initiated remotely, but the CVSS vector indicates low privileges are required. No user interaction is required.
Are public exploits available?
Yes. The exploit has been published and may be used, increasing the likelihood of attempted exploitation.
Which releases are affected or fixed?
The issue affects the project up to commit 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. Because the product uses continuous delivery with rolling releases, no affected or updated release version details are available.
Is a vendor fix available?
The project was informed through an issue report but had not responded at the time of publication. The available data does not identify a vendor-provided fix.