CVE-2026-86269

itsourcecode Sales and Inventory System emp_edit1.php sql injection

View on CVE.org
Published Sep 7, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/emp_edit1.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

Analysis

AI-generated

Technical impact

A vulnerability in the Sales and Inventory System 1.0 identified in the emp_edit1.php module permits an attacker to inject arbitrary SQL through manipulation of the ID argument. The flaw is exploitable remotely by submitting crafted requests to the affected page, giving the attacker the ability to read, modify, or delete records in the underlying database. The vulnerability is classified as a classic SQL injection (CWE-74, CWE-89) and, if the database permits elevated privileges, could lead to data compromise or broader system impact.

Affected Systems

The flaw affects the Sales and Inventory System from itsourcecode, specifically version 1.0. No other versions or additional products are listed as impacted.

Risk and Exploitability

The CVSS score of 5.3 reflects a moderate severity. The EPSS score is not available, but the vulnerability has an existing published exploit, indicating that the attack may be performed remotely. The vulnerability is not included in the CISA KEV catalog, yet the published proof‑of‑concept suggests that systems running the affected version are at risk of compromise if exposed to the internet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest vendor patch or upgrade to a fixed version of the Sales and Inventory System (if available).
  • If an update is not possible, enforce strict input validation on the ID parameter: accept only numeric values and use parameterized queries to eliminate injection risk.
  • Limit remote access to emp_edit1.php by implementing network firewall rules and authentication controls so that only authorized administrative users can reach the vulnerable page.

Generated by OpenCVE AI on September 7, 2026 at 05:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/emp_edit1.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Title itsourcecode Sales and Inventory System emp_edit1.php sql injection
First Time appeared Itsourcecode
Itsourcecode sales And Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode sales And Inventory System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 8, 2026, 3:38 PM
Reserved
Sep 6, 2026, 12:36 PM

View source JSON

Updated
Sep 8, 2026, 3:38 PM

JSON

Status
Deferred
Published
Sep 7, 2026, 4:17 AM
Modified
Oct 24, 2026, 8:10 PM

View source JSON

No data.

Updated
Sep 7, 2026, 5:30 AM

JSON