{"id":"CVE-2026-116055","kind":"vulnerability","aliases":["CVE-2026-116055"],"related":[],"title":"SourceCodester Performance Indicator System: SQL injection in product deletion page","description":"A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.","summary":"The admin page deleteproduct.php in SourceCodester Performance Indicator System 1.0 passes the ID parameter into a SQL query without sanitizing it. A remote attacker can alter database queries to read or change stored data.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","php","self-hosted","sourcecodester"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-25T15:17:02+00:00","first_seen_at":"2026-10-25T15:41:38+00:00","triaged_at":"2026-10-25T15:42:33+00:00","updated_at":"2026-10-25T15:42:33+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T15:42:33Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"SourceCodester Performance Indicator System: SQL injection in product deletion page","impact":"medium","summary":"The admin page deleteproduct.php in SourceCodester Performance Indicator System 1.0 passes the ID parameter into a SQL query without sanitizing it. A remote attacker can alter database queries to read or change stored data.","category":"other","nicknames":[],"who_cares":["php","self-hosted","sourcecodester"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or alters database contents through injected SQL queries","analyst_note":"Confirm whether the admin page requires login and find a fixed version or vendor patch; the NVD entry is the only source.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running SourceCodester Performance Indicator System 1.0 with the /opils/admin/deleteproduct.php file deployed. The sources do not say whether authentication is required to reach the page, so it is unknown whether any exposed instance is reachable by anyone on the internet. Installations that do not use this application can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000554,"input_tokens":3306,"output_tokens":447,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116055':13A,16A '-2026':12A,15A '/opils/admin/deleteproduct.php':75C '1.0':32B,66C 'admin':24B 'alter':48B 'argument':80C 'attack':46B,87C 'chang':54B 'cve':11A,14A 'data':56B 'databas':49B 'delet':9A 'deleteproduct.php':26B 'detect':60C 'exploit':94C 'file':74C 'function':71C 'host':21B 'id':35B,81C 'impact':68C 'indic':3A,30B,64C 'inject':6A,85C 'manipul':77C 'may':88C,99C 'page':10A,25B 'paramet':36B 'pass':33B 'perform':2A,29B,63C,90C 'php':18B 'product':8A 'public':97C 'queri':40B,50B 'read':52B 'remot':45B,92C 'result':82C 'sanit':42B 'self':20B 'self-host':19B 'sourcecodest':1A,22B,28B,62C 'sql':5A,39B,84C 'store':55B 'system':4A,31B,65C 'unknown':70C 'use':101C 'vulner':58C 'without':41B","nicknames":[],"mitigations":[],"who_affected":"Teams running SourceCodester Performance Indicator System 1.0 with the /opils/admin/deleteproduct.php file deployed. The sources do not say whether authentication is required to reach the page, so it is unknown whether any exposed instance is reachable by anyone on the internet. Installations that do not use this application can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T15:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116055","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116055","severity":null,"published_at":"2026-10-25T15:17:02+00:00","modified_at":"2026-10-25T15:17:02+00:00","first_seen_at":"2026-10-25T15:41:38+00:00","fetched_at":"2026-10-25T15:41:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}