CVE-2026-86309: itsourcecode Sales and Inventory System pro_searchfrm.php sql injection
A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/prosearchfrm.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable, but the CVSS vector indicates that the attacker needs low privileges (PR:L). No user interaction is required.
What security impact could successful exploitation have?
Successful SQL injection can affect confidentiality, integrity, and availability at a low level according to the CVSS assessment. The specific database operations or data exposed are not identified in the available information.
Is there public exploit information available?
Yes. An exploit has been published and may be used, increasing the likelihood that attackers could attempt exploitation.