The vulnerability CVE-2026-7077 affects itsourcecode Courier Management System 1.0. It is a SQL injection flaw caused by improper sanitization of the ID parameter in the /edit_parcel.php script. An attacker can remotely inject SQL queries by manipulating this parameter, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. No vendor advisory or patch information is currently available, and the exploit is publicly known.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized disclosure, modification, or deletion of data managed by the Courier Management System. Since the attack vector is remote and requires no privileges or user interaction, the risk is significant for affected installations. However, the CVSS vector indicates low to low impact on confidentiality, integrity, and availability, suggesting limited scope or complexity in exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the /edit_parcel.php endpoint. Additionally, review and harden input validation and parameter sanitization in the affected application code if possible.