CVE-2026-86270: SQL Injection in itsourcecode Sales and Inventory System

This vulnerability affects itsourcecode Sales and Inventory System 1.0. An attacker can manipulate the ID parameter in the /pages/settings_edit.php file to perform SQL injection attacks remotely. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. Exploit code has been publicly disclosed, but no official patch or remediation guidance is available from the vendor at this time.

Successful exploitation allows an attacker to perform SQL injection via the ID parameter, potentially enabling unauthorized access or modification of the database. The vulnerability can be exploited remotely without authentication or user interaction, increasing the risk of compromise. However, the impact is rated medium severity based on CVSS 4.0 metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and monitor for suspicious activity related to the ID parameter. Consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting /pages/settings_edit.php.