Live › vulnerability › CVE-2026-116060
Go to dashboardSourceCodester Performance Indicator System 1.0 fails to sanitize the Contact argument in /opils/staff/adddealer.php, allowing SQL injection. A remote attacker can read or change the application's database, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 17:42 UTC. All times on this page are UTC.
Sites that run SourceCodester Performance Indicator System 1.0 with the /opils/staff/adddealer.php page reachable over the network. The sources do not say whether a login is needed to reach that page, so assume it is exposed to anyone who can load it. Installations that do not deploy this application can skip it.
No product ranges from the sources yet.
/opils/staff/adddealer.php in the web root and check whether the Contact parameter is passed into a SQL query without parameter binding1.0, the version named in the advisoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. Executing a manipulation of the argument Contact can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
This page as .md · .json · in your agent: get_signal("CVE-2026-116060")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.