CVE-2026-86235 MEDIUM

CVE-2026-86235: itsourcecode Sales and Inventory System pos_transac.php add sql injection

Vendor Itsourcecode

Product Sales and Inventory System

Weakness CWE-89 · SQLi

Published September 6, 2026

Last update September 6, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A flaw has been found in itsourcecode Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/pos_transac.php?action=add. This manipulation of the argument Customer causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

Key dates

02Disclosure timeline

September 6, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-86235 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities

04Related CVE

CVE-2026-66458 WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability CVE-2026-16810 Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter CVE-2026-61969 WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability CVE-2026-17589 Shopping Cart & eCommerce Store <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter CVE-2026-78285 WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability