CVE-2026-19925 is a SQL injection vulnerability affecting SourceCodester Stock Management System 1.0. The flaw exists in the processing of the 'ID' argument in the /classes/Master.php?f=delete_supplier file, which allows an attacker to inject malicious SQL commands remotely. This can lead to unauthorized database queries or modifications. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No vendor advisory or patch information is available at this time, and no known exploits in the wild have been reported, although public exploit code exists.

Successful exploitation could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without user interaction but requires high privileges to initiate the attack. The overall impact is rated medium severity based on the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint and validate or sanitize input parameters to mitigate SQL injection risks.