The vulnerability CVE-2026-7592 affects itsourcecode Courier Management System 1.0. It allows an unauthenticated remote attacker to perform SQL injection by manipulating the ID argument in the /edit_staff.php script. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to intermediate impact on confidentiality, integrity, and availability. No official patch or fix has been disclosed, and the exploit code is publicly available.

Successful exploitation can allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. The vulnerability affects confidentiality, integrity, and availability to a low or limited extent as per the CVSS vector. Since the exploit is public, there is an increased risk of attacks targeting vulnerable installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or parameterized queries as a temporary mitigation. Restricting access to the vulnerable script and monitoring for suspicious activity may also help reduce risk.