Threat database

CVE-2026-82540 is a medium severity SQL injection vulnerability in itsourcecode Sales and Inventory System version 1.0. The flaw exists in an unknown function within the /pages/cust_searchfrm.php file, where manipulation of the ID argument allows SQL injection. Remote exploitation is possible, and public exploit code is available. No official patch or remediation guidance has been provided by the vendor as of the publication date.

CVE-2026-82485 is a medium severity SQL injection vulnerability in itsourcecode Sales and Inventory System version 1.0. The flaw exists in an unknown functionality of the /pages/pro_edit.php file, where manipulation of the ID argument allows remote attackers to perform SQL injection. The vulnerability has a public exploit disclosed but no official patch or remediation information is currently available.

CVE-2026-82484 is a medium severity SQL injection vulnerability in itsourcecode Sales and Inventory System version 1.0. The flaw exists in an unknown function within the /pages/emp_searchfrm.php file, where manipulation of the ID argument allows remote attackers to perform SQL injection. Exploit code has been published, but no known active exploitation in the wild has been reported. No official patch or remediation guidance is currently available.

CVE-2026-82422 is a medium severity SQL injection vulnerability in itsourcecode Sales and Inventory System version 1.0. The flaw exists in an unknown function within the /pages/emp_del.php file, where manipulation of the ID argument allows SQL injection. The vulnerability can be exploited remotely and public exploit code is available. No official patch or remediation guidance has been provided yet.

CVE-2026-82421 is a medium severity SQL injection vulnerability in itsourcecode Sales and Inventory System version 1.0. The issue arises from improper handling of the ID parameter in the /pages/emp_edit.php file, allowing remote attackers to inject SQL commands. Exploit code is publicly available, but no official patch or remediation guidance has been provided by the vendor.

CVE-2026-81202 is a medium severity vulnerability in itsourcecode Payroll System version 1.0. The flaw exists in the CRUD Operation Handler component's ajax.php file, where manipulation of the 'action' argument can bypass authentication. This allows remote attackers to perform create, read, update, or delete operations without proper authentication. Exploit code has been published, but there are no known exploits in the wild. No official patch or remediation guidance is currently available.

CVE-2026-78656 is a medium severity SQL injection vulnerability in itsourcecode Sales and Inventory System version 1.0. The flaw exists in an unknown function within the /pages/cust_del.php file, where manipulation of the ID parameter allows remote attackers to perform SQL injection. Exploit code has been publicly disclosed, but no official patch or remediation guidance is currently available.

CVE-2026-78246 is a SQL injection vulnerability in itsourcecode Online Clinic Management System version 1.0. The flaw exists in the Admin Login component, specifically in the success/login.php file, where manipulation of the Username argument allows SQL injection. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

CVE-2026-78245 is a medium severity vulnerability in itsourcecode Online Pharmacy System 1.0. It involves an unrestricted file upload flaw in the move_uploaded_file function within the User Registration component (all_users/register.php). This vulnerability allows remote attackers to manipulate the photo argument to upload arbitrary files. An exploit has been published, but no known active exploitation in the wild is reported.

CVE-2026-78244 is a SQL injection vulnerability in itsourcecode Real Estate Management System version 1.0. The flaw exists in the search.php file, where manipulation of parameters such as search, delivery_type, search_price, or property_type can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Public exploit code is available. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

CVE-2026-78202 is a medium severity vulnerability in itsourcecode Payroll System version 1.0. It involves an unrestricted file upload flaw in the save_settings function of the admin_class.php file. This vulnerability allows remote attackers to upload files without restriction by manipulating the img argument. Exploit code has been publicly disclosed, but no known active exploitation in the wild has been reported.

CVE-2026-78201 is a medium severity SQL injection vulnerability in itsourcecode Payroll System version 1.0. The flaw exists in the Login function of the admin_class.php file, where manipulation of the Username argument allows remote attackers to execute SQL injection attacks. The vulnerability has been publicly disclosed, but no official patch or fix information is provided.

CVE-2026-78200 is a medium severity SQL injection vulnerability in itsourcecode Library Management System version 1.0. The flaw exists in an unknown function within the editbooks.php file, where manipulation of the ID argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. An exploit has been published, but there are no known reports of active exploitation in the wild. No patch or official remediation has been provided yet.

CVE-2026-78185 is a medium severity SQL injection vulnerability in itsourcecode Sales and Inventory System version 1.0. The flaw exists in an unknown function within the /pages/cust_edit.php file, where manipulation of the ID parameter allows remote attackers to perform SQL injection. Exploit code is publicly available, but no known active exploitation in the wild has been reported. No official patch or remediation details are provided.

CVE-2026-78171 is a medium severity SQL injection vulnerability in itsourcecode Sales and Inventory System version 1.0. The flaw exists in an unknown functionality within the /pages/processlogin.php file, where manipulation of the User argument allows remote attackers to perform SQL injection. The vulnerability has been publicly disclosed, but no official patch or remediation information is provided.

CVE-2026-78112 is a medium severity SQL injection vulnerability in itsourcecode Hospital Management System Project in PHP version 1.0. The flaw exists in the /viewservicetype.php file, where manipulation of the 'delid' argument allows an attacker to perform SQL injection remotely. Exploit code has been published, but no official patch or remediation guidance is currently available.

A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.