CVE-2026-4826

SourceCodester Sales and Inventory System HTTP GET Parameter update_stock.php sql injection

CVSS 5.3 MEDIUMEPSS 0.3%CWE-74 CWE-89

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

25 mar 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /update_stock.php of the component HTTP GET Parameter Handler. This manipulation of the argument sid causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Produtos afetados

SourceCodester · Sales and Inventory System

Referências

https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-UpdateStock-sid.md https://vuldb.com/?ctiid.353126 https://vuldb.com/?id.353126 https://vuldb.com/?submit.775177 https://www.sourcecodester.com/