CVE-2026-19021 is a SQL injection vulnerability affecting SourceCodester Computer Repair Shop Management System version 1.0. The issue exists in the delete_product functionality within /classes/Master.php, where the ID parameter is not properly sanitized, allowing remote attackers to inject SQL commands. This vulnerability can be exploited without authentication and does not require user interaction. Public exploit code has been disclosed, increasing the risk of exploitation. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, data modification, or deletion. The vulnerability is remotely exploitable without authentication, increasing its risk. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the delete_product endpoint. Review and sanitize all user inputs, especially the ID parameter in the affected functionality.