CVE-2026-11495: CodeAstro Ingredients Stock Management System add_stock.php sql injection
A vulnerability was detected in CodeAstro Ingredients Stock Management System 1.0. This impacts an unknown function of the file /Ingredients-Stock/addstock.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or block the /Ingredients-Stock/add_stock.php endpoint (for example remove the route, disable the script, or return 403) until the vulnerable code is fixed or validated.
CodeAstro Ingredients Stock Management System (file: /Ingredients-Stock/add_stock.php) endpoint_enabled = false - Compensating control
Restrict remote access to the application and to the /Ingredients-Stock/add_stock.php endpoint (for example via firewall rules or IP allowlist) and/or place the application behind a Web Application Firewall tuned to block SQL injection payloads.
- Operational
Review access and application logs for signs of exploitation of add_stock.php, and if compromise is suspected rotate any credentials or secrets that may have been exposed and increase monitoring.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11495?
The severity of CVE-2026-11495 is medium with a score of 6.3.
How do I fix CVE-2026-11495?
To fix CVE-2026-11495, sanitize and validate inputs to prevent SQL injection in the add_stock.php file.
What type of attack is possible with CVE-2026-11495?
CVE-2026-11495 allows for SQL injection attacks that can be launched remotely.
Which software is affected by CVE-2026-11495?
CVE-2026-11495 affects CodeAstro Ingredients Stock Management System version 1.0.
What function in the software is vulnerable due to CVE-2026-11495?
The vulnerability in CVE-2026-11495 occurs in an unknown function of the /Ingredients-Stock/add_stock.php file.