CVE-2026-76785 - Vulnerability Details

- amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection

Description

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file application/models/Transaction.php. Performing a manipulation of the argument orderBy/orderFormat results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Published: 2026-08-20

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Mini-Inventory-and-Sales-Management-System 0.1 application’s Transaction::getAll function permits attackers to manipulate the orderBy and orderFormat arguments, resulting in SQL injection that can be triggered remotely. The vulnerability is graded moderate (CVSS 5.3) and has an exploit that has been publicly released, making it a realistic threat for affected deployments where the component is accessible from the internet.

Affected Systems

The vulnerable product is amirsanni’s Mini-Inventory-and-Sales-Management-System version 0.1. No other versions or modules have been identified as affected by the current CVE.

Risk and Exploitability

With a CVSS score of 5.3 the risk is moderate. The exploit can be launched from any client that can reach the Transaction endpoint, and because the vulnerability is not catalogued in KEV there is no prior mitigation flag. The EPSS score is not available, but the public release of the exploit increases the likelihood of real‑world attacks.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

amirsanni

Mini-Inventory-and-Sales-Management-System

affected

Version	Status	Constraints
`0.1`	affected	—

No data.

Vendor Product Confidence Versions

Amirsanni

Mini-inventory-and-sales-management-system

100%

Version	Status	Scheme	Platform
`0.1`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Sanitize the orderBy and orderFormat parameters and use parameterized queries or a whitelist of allowed values.
Restrict access to the Transaction::getAll endpoint to authenticated and properly authorized users only.
Monitor application logs for anomalous SQL patterns and apply rate‑limiting or blocking against repeated injection attempts.

Generated by OpenCVE AI on August 20, 2026 at 08:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.002.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/amirsanni/Mini-Inventory-and-Sales-Management-System/
https://github.com/amirsanni/Mini-Inventory-and-Sales-Management-System/issues/101
https://vuldb.com/cve/CVE-2026-76785
https://vuldb.com/submit/879829
https://vuldb.com/vuln/393250
https://vuldb.com/vuln/393250/cti

History

Fri, 21 Aug 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 20 Aug 2026 00:45:00 +0000

Type	Values Removed	Values Added
Description		A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file application/models/Transaction.php. Performing a manipulation of the argument orderBy/orderFormat results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title		amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection
First Time appeared		Amirsanni Amirsanni mini-inventory-and-sales-management-system
Weaknesses		CWE-74 CWE-89
CPEs		cpe:2.3:a:amirsanni:mini-inventory-and-sales-management-system::::::::
Vendors & Products		Amirsanni Amirsanni mini-inventory-and-sales-management-system
References		https://github.com/amirsanni/Mini-Inventory-and-Sales-Management-System/ https://github.com/amirsanni/Mini-Inventory-and-Sales-Management-System/issues/101 https://vuldb.com/cve/CVE-2026-76785 https://vuldb.com/submit/879829 https://vuldb.com/vuln/393250 https://vuldb.com/vuln/393250/cti
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Amirsanni Mini-inventory-and-sales-management-system

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-08-20T00:30:10.777Z

Updated: 2026-08-20T15:14:30.448Z

Reserved: 2026-08-19T17:34:34.712Z

Link: CVE-2026-76785

Vulnrichment

Updated: 2026-08-20T15:14:26.852Z

NVD

Status : Deferred

Published: 2026-08-20T01:16:54.100

Modified: 2026-08-20T16:18:20.453

Link: CVE-2026-76785

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-20T09:07:31Z

Weaknesses

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object