CVE-2026-86236: itsourcecode Sales and Inventory System pro_transac.php add sql injection
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/protransac.php?action=add. Such manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an authenticated user or user interaction?
The CVSS vector indicates that an attacker needs low-level privileges (PR:L). No user interaction is required (UI:N).
How can an attacker reach the vulnerable functionality?
The issue is remotely exploitable over the network (AV:N) and has low attack complexity (AC:L). A public exploit has been disclosed, which may increase the likelihood of attempted exploitation.
What is the expected security impact if exploitation succeeds?
The CVSS assessment rates impact to confidentiality, integrity, and availability as low (C:L/I:L/A:L). The overall severity is medium, with a CVSS score of 6.3.