CVE-2026-86245: SQL Injection in itsourcecode Sales and Inventory System

The vulnerability CVE-2026-86245 affects itsourcecode Sales and Inventory System version 1.0. It is a SQL injection flaw located in an unspecified functionality within the /pages/sup_transac.php file. By manipulating the 'companyname' parameter, an attacker can inject SQL commands remotely without user interaction or elevated privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. Exploit code is publicly available, but no vendor patch or fix details are provided in the data.

Successful exploitation allows remote attackers to execute arbitrary SQL commands via the 'companyname' parameter, potentially leading to unauthorized data access or modification within the affected system. The vulnerability requires no user interaction and has low complexity, but limited privileges are needed. The impact is limited by the vulnerability's scope and the lack of detailed information on the affected functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint, applying web application firewalls to detect and block SQL injection attempts, and reviewing input validation controls on the 'companyname' parameter.