CVE-2026-86269: itsourcecode Sales and Inventory System emp_edit1.php sql injection
A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/empedit1.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The vector requires network access and low privileges. No user interaction is required, so an authenticated low-privilege user who can reach the affected endpoint is the relevant threat model.
Which input and endpoint should be prioritized for review?
Prioritize /pages/emp_edit1.php and its ID argument. The reported flaw is SQL injection caused by manipulation of that argument.
How urgent is remediation?
The issue is rated medium severity with a 6.3 score, but a public exploit has been published and remote exploitation is possible. Treat reachable instances where low-privilege accounts exist as a practical exposure.