CVE-2026-86235: itsourcecode Sales and Inventory System pos_transac.php add sql injection
A flaw has been found in itsourcecode Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/postransac.php?action=add. This manipulation of the argument Customer causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs network access to the affected application and low-privileged access, as reflected by the PR:L vector. No user interaction is required.
Which input and endpoint should be prioritized for testing or monitoring?
Prioritize requests to /pages/pos_transac.php?action=add, specifically handling of the Customer argument. The available information identifies this parameter as the SQL injection point.
How mature is public exploitation?
A public exploit has been published and may be used. This increases the likelihood that exposed deployments could be targeted.