CVE-2026-86235: SQL Injection in itsourcecode Sales and Inventory System

The vulnerability CVE-2026-86235 affects itsourcecode Sales and Inventory System version 1.0. It is a SQL injection flaw in the /pages/pos_transac.php endpoint when the 'Customer' parameter is manipulated. This allows an attacker to inject SQL commands remotely with low attack complexity and no user interaction required. The CVSS 4.0 base score is 5.3 (medium severity), reflecting limited confidentiality, integrity, and availability impact. Exploit code has been published, but no known active exploitation has been reported. No vendor advisory or patch information is available at this time.

Successful exploitation of this vulnerability could allow an attacker with low privileges to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access or modification with limited impact on confidentiality, integrity, and availability as indicated by the CVSS vector. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected endpoint and validate or sanitize input parameters on the 'Customer' argument to mitigate SQL injection risks.