Live › vulnerability › CVE-2026-114252
Go to dashboardAn unauthenticated remote attacker can inject SQL through the ID argument of /pages/cust_searchfrm.php in itsourcecode's Sales-and-Inventory-System. Successful injection can expose or alter the database contents, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running itsourcecode Sales-and-Inventory-System up to commit 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac, reachable over the network. Installations not exposed to the internet, or that do not use this project, can skip it.
No product ranges from the sources yet.
pages/cust_searchfrm.php in the deployed application and check whether the ID parameter is passed unescaped into a SQL querypages/cust_searchfrm.php endpoint until a fix is confirmedID query in that file if you maintain the codeEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. The affected element is an unknown function of the file /pages/cust_searchfrm.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-114252")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.