CVE-2026-86233: SQL Injection in itsourcecode Sales and Inventory System

This vulnerability affects itsourcecode Sales and Inventory System version 1.0. An attacker can remotely exploit a SQL injection flaw by manipulating the 'ID' parameter in the /pages/us_del.php?type=user endpoint. The vulnerability allows unauthorized SQL commands to be executed, potentially compromising the database. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. The vulnerability has been publicly disclosed but no vendor patch or fix information is available.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impact as per the CVSS vector. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the vulnerable endpoint and employing web application firewalls that detect SQL injection attempts may help mitigate risk.