CVE-2026-86164: itsourcecode Sales and Inventory System trans_view.php sql injection
A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/transview.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The available severity vector indicates that an attacker needs low privileges (PR:L). The attack can be performed remotely and does not require user interaction.
How likely is exploitation in practice?
An exploit has been publicly released, and the exploit maturity is rated proof-of-concept (E:P). Systems reachable over the network where low-privileged users can access trans_view.php should be prioritized for review.
Which component should be investigated for signs of exposure?
Review requests to /pages/trans_view.php, especially those supplying the ID argument. The reported injection point is manipulation of that ID parameter.