A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. (CVE-2026-82421)

The vulnerability identified as CVE-2026-82421 affects itsourcecode Sales and Inventory System version 1.0. It involves improper handling of the ID parameter in the /pages/emp_edit.php file, leading to SQL injection (CWE-89) and improper neutralization of special elements in output (CWE-74). The attack vector is network-based with low attack complexity and requires low privileges, without user interaction. The impact includes low confidentiality, integrity, and availability impacts. Exploit code is publicly available, but no active exploitation has been reported.

Successful exploitation could allow an attacker with low privileges to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access, modification, or disruption of service. The impact is rated low in confidentiality, integrity, and availability, reflecting limited but non-negligible risk.

No official patch or remediation has been disclosed by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected system and monitor for suspicious activity related to the emp_edit.php endpoint. Consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter.