CVE-2026-86164: SQL Injection in itsourcecode Sales and Inventory System

The vulnerability CVE-2026-86164 affects itsourcecode Sales and Inventory System version 1.0. It is an SQL injection flaw located in an unknown function of the /pages/trans_view.php file. The issue arises from improper handling of the ID parameter, which can be manipulated remotely to inject SQL commands. The CVSS 4.0 base score is 5.3 (medium severity), with attack vector network, low attack complexity, no user interaction, and low privileges required. The vulnerability has been publicly disclosed with exploit code available, but no vendor patch or fix information is provided.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the database permissions. The vulnerability is remotely exploitable without user interaction and requires only low privileges, increasing the risk. However, the CVSS impact metrics indicate low confidentiality, integrity, and availability impact, suggesting limited but non-negligible damage potential.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the ID parameter in /pages/trans_view.php to mitigate SQL injection risks. Monitor for any updates from the vendor regarding patches or official mitigations.