CVE-2026-114252: itsourcecode Sales-and-Inventory-System cust_searchfrm.php sql injection
A vulnerability was found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. The affected element is an unknown function of the file /pages/custsearchfrm.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely, but the CVSS vector indicates that low-level privileges are required. No user interaction is required.
Are fixed versions available?
Specific affected or updated release versions are not available because the product uses a rolling release model. The project was notified through an issue report but had not responded at the time of the report.
How urgent is remediation?
A public exploit is available, and successful exploitation can affect confidentiality, integrity, and availability at a low impact level. Prioritize systems where low-privileged authenticated users can reach /pages/cust_searchfrm.php and supply the ID argument.