CVE-2026-90600

itsourcecode Sales and Inventory System inv_edit1.php sql injection

View on CVE.org
Published Sep 13, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Analysis

AI-generated

Technical impact

The vulnerability resides in the inv_edit1.php page of itsourcecode's Sales and Inventory System. An attacker that can influence the ID argument can inject arbitrary SQL commands into the backend, a flaw that aligns with CWE-74 and CWE-89, modify, or delete data stored in the database, potentially compromising the confidentiality, integrity, or availability of the inventory system.

Affected Systems

The affected product is itsourcecode Sales and Inventory System version 1.0. The vulnerability was reported to affect an unknown function within the file /pages/inv_edit1.php. No other product versions are listed.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is 0.00204, indicating a very low expected exploitation probability, but the vulnerability can be reached from the Internet and the exploit has already been disclosed publicly. The vulnerability is not listed in the CISA KEV catalog. Therefore, organizations that run this product should consider the risk moderate but potentially exploitable from remote hosts.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest release of itsourcecode Sales and Inventory System once an update that removes the SQL injection flaw is available.
  • Restrict access to /pages/inv_edit1.php by configuring network firewalls or web server access controls to limit exposure to trusted IP ranges.
  • Modify the application code to validate the ID value strictly and use prepared statements or parameterized queries to eliminate injection possibilities.

Generated by OpenCVE AI on September 15, 2026 at 16:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Title itsourcecode Sales and Inventory System inv_edit1.php sql injection
First Time appeared Itsourcecode
Itsourcecode sales And Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:sales_and_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode sales And Inventory System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 15, 2026, 1:58 PM
Reserved
Sep 12, 2026, 6:47 PM

View source JSON

Updated
Sep 15, 2026, 1:42 PM

JSON

Status
Deferred
Published
Sep 13, 2026, 11:16 PM
Modified
Sep 15, 2026, 2:17 PM

View source JSON

No data.

Updated
Sep 15, 2026, 4:30 PM

JSON