CVE-2026-90574: itsourcecode Sales and Inventory System emp_transac.php add sql injection
A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/emptransac.php?action=add. The manipulation of the argument firstname results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be performed remotely and requires low-privileged access. No user interaction is required, and the attack complexity is rated low.
Which deployments should be investigated?
Investigate deployments of itsourcecode Sales and Inventory System 1.0 that expose the emp_transac.php endpoint with action=add. The affected input is the firstname argument.
How urgent is remediation or mitigation?
A public exploit has been released, so affected systems may be targeted. The available severity data indicates low potential impact to confidentiality, integrity, and availability, but all three impact categories are affected.