CVE-2026-82609: SQL Injection in itsourcecode Sales and Inventory System

This vulnerability affects itsourcecode Sales and Inventory System 1.0. An attacker can remotely exploit a SQL injection flaw by manipulating the ID argument in the /pages/inv_edit.php file. The vulnerability allows unauthorized SQL queries to be executed, potentially compromising the database. The CVSS 3.1 base score is 5.3 (medium severity), indicating a network attack vector with low complexity and no user interaction required. No patch or official fix is currently available, and no known active exploitation has been reported.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium severity and the vulnerability has low complexity and no user interaction required. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint and apply input validation or web application firewall rules to mitigate SQL injection risks.