CVE-2026-108965: SQL Injection in SourceCodester Performance Indicator System

CVE-2026-108965 is a SQL injection vulnerability in SourceCodester Performance Indicator System 1.0. The flaw exists in the /opils/staff/edit_quantity.php script where the 'pqty' parameter is not properly sanitized, enabling remote attackers to inject SQL commands. The vulnerability has been publicly disclosed, but there is no information about an official patch or remediation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the CVSS impact metrics indicate only low confidentiality, integrity, and availability impacts, suggesting limited damage. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to apply input validation and sanitization on the 'pqty' parameter to prevent SQL injection. Monitor for any updates from the vendor regarding patches or official mitigations.