CVE-2026-90525: itsourcecode Sales and Inventory System cust_pos_trans.php sql injection
Published Sep 13, 2026
·Updated
A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/custpostrans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
1 affected component
itsourcecode Sales and Inventory System=1.0
Event History
Sep 13, 2026
CVE Published
via MITRE·01:45 PM
Data Sourced
via MITRE·01:45 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs remote network access and low-privileged access to the application. No user interaction is required.
2
What input should be investigated?
The affected input is the firstname argument handled by /pages/cust_pos_trans.php. Review requests reaching that endpoint and application or database logs for suspicious SQL-related content in this parameter.
3
Is public exploitation material available?
Yes. The exploit has been publicly disclosed and could be used in attacks.