Live › vulnerability › CVE-2026-116055
Go to dashboardThe admin page deleteproduct.php in SourceCodester Performance Indicator System 1.0 passes the ID parameter into a SQL query without sanitizing it. A remote attacker can alter database queries to read or change stored data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 15:41 UTC. All times on this page are UTC.
Teams running SourceCodester Performance Indicator System 1.0 with the /opils/admin/deleteproduct.php file deployed. The sources do not say whether authentication is required to reach the page, so it is unknown whether any exposed instance is reachable by anyone on the internet. Installations that do not use this application can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-116055")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.