A vulnerability has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. (CVE-2026-114251)

The itsourcecode Sales-and-Inventory-System contains a SQL injection vulnerability in an unknown function within /pages/cust_del.php. Manipulating the ID parameter leads to SQL injection, which can be exploited remotely. The product lacks versioning, preventing clear identification of affected versions. The vulnerability has been publicly disclosed, and an exploit is available. The project has been notified but has not issued a fix or response.

Successful exploitation of this vulnerability can lead to unauthorized SQL commands being executed on the backend database, potentially resulting in data disclosure, data modification, or denial of service. The CVSS score of 6.3 indicates a medium severity impact with low complexity and no user interaction required. The vulnerability affects confidentiality, integrity, and availability to a limited extent.

No official fix or patch is currently available as the project has not responded to the issue report. Users should apply compensating controls such as input validation and parameterized queries if possible. Monitor for updates from the project for an official remediation. Patch status is not yet confirmed — check the vendor advisory or project repository for current remediation guidance.