MEDIUM

CVE-2026-90525

2026-09-13 CVSS v3.1

CVSS

6.3

Description

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/cust_pos_trans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

Weakness (CWE)

CWE-74 Injection

CWE-89 SQL Injection

EPSS Score

0.33%

Probability of exploitation in next 30 days

26.7th percentile

References

https://github.com/abigmalon/submit_cve/issues/1 https://itsourcecode.com/ https://vuldb.com/cve/CVE-2026-90525 https://vuldb.com/submit/912526 https://vuldb.com/vuln/403115 https://vuldb.com/vuln/403115/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE