Live › vulnerability › CVE-2026-116061
Go to dashboardSourceCodester Performance Indicator System 1.0 (a free sample PHP/MySQLi app) builds an SQL query from the contact field in /opils/staff/edit_dealer.php without sanitizing it. A public write-up shows a time-based blind SQL injection with sqlmap, which can read or change the database. Other pages in the same app have similar published injection bugs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 19:05 UTC. All times on this page are UTC.
Sites that run SourceCodester Performance Indicator System 1.0 with the edit_dealer.php page reachable. Installations that do not use this software can skip it. The sources do not say whether a patch or newer version exists.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Performance Indicator System | vendor | 1.0 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-116061")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.