CVE-2026-86270: itsourcecode Sales and Inventory System settings_edit.php sql injection
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/settingsedit.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attack is remote over the network but requires low-level privileges. No user interaction is required.
Which deployments should be treated as affected?
itsourcecode Sales and Inventory System version 1.0 should be treated as affected where the /pages/settings_edit.php endpoint is present. The available information does not identify any other affected or unaffected versions.
How urgent is remediation?
Public exploit disclosure is reported, so attackers may be able to use existing exploit information. The recorded severity is medium with impacts to confidentiality, integrity, and availability.