A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. (CVE-2026-86163)

The itsourcecode Sales and Inventory System 1.0 contains a SQL injection vulnerability in the /pages/pro_del.php file. The vulnerability arises from manipulation of the ID parameter, allowing an attacker to execute unauthorized SQL commands remotely. Public exploit code exists for this vulnerability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, and impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation could allow an attacker to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access, modification, or disruption of service. The CVSS score of 6.3 reflects a medium impact on confidentiality, integrity, and availability. However, the exact scope of affected functionality is unknown.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the vulnerable endpoint and validate or sanitize input parameters to mitigate SQL injection risks.