Description
A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_searchfrm.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-08-31
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unknown function in /pages/inv_searchfrm.php in itsourcecode Sales and Inventory System 1.0 allows manipulation of the ID argument to inject arbitrary SQL. The injection can let an attacker read, modify, or delete data from the underlying database, thereby compromising confidentiality, integrity, and potentially availability of the system.

Affected Systems

The vulnerable product is itsourcecode Sales and Inventory System version 1.0. No other versions are listed as affected.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be initiated remotely with a crafted ID parameter, and public exploits have been made available, suggesting that the risk of exploitation is non‑zero and that attackers can target the system over the network.

Generated by OpenCVE AI on August 31, 2026 at 15:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a patched version of itsourcecode Sales and Inventory System that sanitizes the ID parameter or uses parameterized queries.
  • If a patch is unavailable, modify inv_searchfrm.php to enforce strict numeric validation on the ID argument and reject any non‑numeric input.
  • Deploy a web application firewall or input‑validation gateway to detect and block SQL‑injection payloads targeting the inv_searchfrm.php endpoint.

Generated by OpenCVE AI on August 31, 2026 at 15:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_searchfrm.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Title itsourcecode Sales and Inventory System inv_searchfrm.php sql injection
First Time appeared Itsourcecode
Itsourcecode sales And Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode sales And Inventory System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Sales And Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T13:00:11.102Z

Reserved: 2026-08-30T17:45:44.102Z

Link: CVE-2026-82696

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T13:18:30.140

Modified: 2026-08-31T13:18:30.140

Link: CVE-2026-82696

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T15:15:14Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')