CVE-2026-86245: itsourcecode Sales and Inventory System sup_transac.php sql injection
A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/suptransac.php. Performing a manipulation of the argument companyname results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of itsourcecode Sales and Inventory System 1.0 are affected where the /pages/sup_transac.php endpoint is reachable by an attacker who has the required low-level privileges.
What does an attacker need to exploit it?
The attack can be initiated remotely and does not require user interaction. The attacker needs low privileges and can manipulate the companyname argument supplied to /pages/sup_transac.php.
Is public exploit material available?
Yes. The available data states that a public exploit exists and may be used.