CVE-2026-19787 is a SQL injection vulnerability in SourceCodester Air Cargo Management System 1.0. It affects an unknown function within /classes/Master.php?f=save_cargo_type. An attacker can manipulate the ID parameter to perform SQL injection remotely. The vulnerability has a CVSS 3.1 base score of 4.7 (low severity) with attack vector network, low attack complexity, high privileges required, no user interaction, and impacts confidentiality, integrity, and availability at a low level. The exploit has been publicly disclosed but no active exploitation is known. No patch or vendor advisory is provided.

Successful exploitation could allow an attacker with high privileges to remotely perform SQL injection via the ID parameter, potentially leading to limited confidentiality, integrity, and availability impacts. However, the attack requires high privileges and no user interaction, which limits the risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected function to trusted users only and monitor for unusual activity related to the save_cargo_type function. Avoid exposing the vulnerable endpoint to untrusted networks if possible.