A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. (CVE-2026-82485)

The itsourcecode Sales and Inventory System version 1.0 contains a SQL injection vulnerability in an unspecified functionality within the /pages/pro_edit.php file. Manipulating the ID parameter allows an attacker to inject SQL commands remotely. The vulnerability is tracked as CVE-2026-82485 with a CVSS 3.1 score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). There is no vendor advisory or patch information available, and no known exploits are currently active in the wild.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands remotely, potentially leading to limited confidentiality, integrity, and availability impacts on the affected system. The impact is rated as low by the database but the CVSS score suggests a medium severity due to the remote attack vector and potential data manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, restrict access to the vulnerable functionality and validate or sanitize input parameters to mitigate SQL injection risks.