Live › vulnerability › CVE-2026-114251
Go to dashboardThe itsourcecode Sales-and-Inventory-System PHP application does not properly handle the ID argument in /pages/cust_del.php, allowing SQL injection. An attacker who can reach the page can read or alter the application's database, and the exploit has been published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any deployment of the itsourcecode Sales-and-Inventory-System up to the named commit that exposes the cust_del.php page is affected, since the flaw is in how that page passes the ID argument into SQL. Teams that do not run this application can skip it. Whether a login is needed to reach the page is not stated in the sources.
No product ranges from the sources yet.
/pages/cust_del.php is reachable on the server0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac revision the sources name, since the project does not use versions/pages/cust_del.php at the web server or network until a patch existscust_del.phpEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. Impacted is an unknown function of the file /pages/cust_del.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-114251")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.