The vulnerability CVE-2026-86675 affects itsourcecode Sales and Inventory System version 1.0. It is an SQL injection issue located in an unspecified part of the /pages/us_edit.php file. By manipulating the ID argument, an attacker can inject SQL commands remotely without requiring user interaction. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. Public exploit code exists, but no vendor patch or official remediation has been disclosed.

Successful exploitation allows an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impact and the requirement of low privileges.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, consider restricting access to the vulnerable endpoint and applying web application firewall rules to detect and block SQL injection attempts targeting the ID parameter.