Live › vulnerability › CVE-2026-116062
Go to dashboardThe Performance Indicator System 1.0 PHP application does not sanitize the Contact argument in /opils/staff/save_profile.php before using it in a SQL query. A remote attacker can alter database queries to read or change stored data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 19:05 UTC. All times on this page are UTC.
Teams running SourceCodester Performance Indicator System 1.0 with the OPILS staff module reachable from the network. The flaw sits in the staff profile save handler, so instances where that page is not exposed carry less risk. Sites not running this product can skip it.
No product ranges from the sources yet.
opils/staff/save_profile.php on the server running Performance Indicator SystemEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php. The manipulation of the argument Contact results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-116062")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.