← back
CVE-2026-4570

SourceCodester Sales and Inventory System HTTP POST Request view_customers.php sql injection

CVSS 5.3 MEDIUMEPSS 0.3%CWE-74CWE-89
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
23 Mar 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
A vulnerability was identified in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /view_customers.php of the component HTTP POST Request Handler. Such manipulation of the argument searchtxt leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
SourceCodester · Sales and Inventory System
References
https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-ViewCustomers-searchtxt.mdhttps://vuldb.com/?ctiid.352407https://vuldb.com/?id.352407https://vuldb.com/?submit.775165https://www.sourcecodester.com/