Description
A flaw has been found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/emp_searchfrm.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
Published: 2026-08-30
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in an unknown function of /pages/emp_searchfrm.php in itsourcecode Sales and Inventory System 1.0, where manipulating the ID argument leads to unauthenticated SQL injection. A remote attacker could execute arbitrary SQL statements, enabling read, modify or delete operations on the underlying database, thereby compromising confidentiality and integrity of business data.

Affected Systems

itsourcecode Sales and Inventory System version 1.0 is affected. No other vendors or product variations are listed.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is reported as remote; an attacker can trigger the flaw by sending crafted requests to emp_searchfrm.php. An exploit has been published and is known to be usable.

Generated by OpenCVE AI on August 30, 2026 at 09:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update itsourcecode Sales and Inventory System to a patched version that fixes the SQL injection in emp_searchfrm.php.
  • If a patch is unavailable, restrict remote access to emp_searchfrm.php and validate or sanitize the ID input to prevent SQL injection.
  • Enable database and web application logging and monitor for unusual queries or access patterns.

Generated by OpenCVE AI on August 30, 2026 at 09:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 30 Aug 2026 08:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/emp_searchfrm.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
Title itsourcecode Sales and Inventory System emp_searchfrm.php sql injection
First Time appeared Itsourcecode
Itsourcecode sales And Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode sales And Inventory System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Sales And Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-30T08:30:08.649Z

Reserved: 2026-08-29T16:09:44.635Z

Link: CVE-2026-82484

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-30T09:16:46.433

Modified: 2026-08-30T09:16:46.433

Link: CVE-2026-82484

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-30T10:30:16Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')