CVE-2026-86265: SQL Injection in itsourcecode Sales and Inventory System

This vulnerability affects itsourcecode Sales and Inventory System version 1.0. It involves SQL injection via the Username parameter in the /pages/us_transac.php file. The vulnerability allows remote attackers to inject SQL commands due to insufficient input validation or sanitization. The CVSS 4.0 score is 5.3 (medium severity), indicating a network attack vector with low complexity and no user interaction required. Exploit code has been publicly disclosed, but there is no indication of active exploitation in the wild or an official patch.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the low privileges required and the low complexity of the attack, but the exact consequences depend on the database and application context.

No official patch or remediation information is currently available. Users of itsourcecode Sales and Inventory System 1.0 should monitor vendor advisories for updates. In the meantime, applying input validation and sanitization on the Username parameter or restricting access to the vulnerable endpoint may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.