The vulnerability CVE-2026-78185 affects itsourcecode Sales and Inventory System version 1.0. It is a SQL injection issue caused by improper handling of the ID parameter in a function within /pages/cust_edit.php. This allows remote attackers to inject SQL commands, potentially compromising the database. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity). Exploit code is publicly known, but there is no vendor-provided patch or official remediation level indicated.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. However, the CVSS vector indicates low privileges required and low impact on confidentiality, integrity, and availability, resulting in a medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the vulnerable function or applying web application firewall rules to detect and block SQL injection attempts targeting the ID parameter in /pages/cust_edit.php.