This vulnerability affects Campcodes Complete POS Management and Inventory System versions 4.0.0 through 4.0.6. It involves an injection flaw in an unknown function of the Environment Variable Handler component located in app/Http/Controllers/SettingsController.php. The vulnerability can be triggered remotely and does not require user interaction or elevated privileges beyond low-level access. The CVSS 4.0 base score is 5.3, indicating a medium severity risk. The vulnerability was publicly disclosed on 2026-04-05, but no official remediation or patch is currently documented.

Successful exploitation of this injection vulnerability could allow an attacker to manipulate the system remotely, potentially leading to unauthorized code execution or data manipulation within the affected component. The medium CVSS score reflects a moderate risk, with the attack vector being network-based and requiring low privileges but no user interaction. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround has been published, users should monitor vendor communications for updates. Until a patch is available, consider restricting network access to the affected application and applying compensating controls where feasible.