Medium severity · published Oct 21, 2026
CVE-2026-114250
itsourcecode Sales-and-Inventory-System cust_edit.php sql injection
New
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A flaw has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. This issue affects some unknown processing of the file /pages/cust_edit.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Sales-and-Inventory-System · itsourcecode
0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114250
github.com
https://github.com/DefaultFuction/Sales-and-Inventory-System/issues/1
itsourcecode.com
https://itsourcecode.com/
vuldb.com
https://vuldb.com/cve/CVE-2026-114250
vuldb.com
https://vuldb.com/submit/1018590
vuldb.com
https://vuldb.com/vuln/424682
vuldb.com
https://vuldb.com/vuln/424682/cti
More from Sales-and-Inventory-System
7.3
CVE-2026-78171
itsourcecode Sales and Inventory System processlogin.php sql injection
6.3
CVE-2026-114252
itsourcecode Sales-and-Inventory-System cust_searchfrm.php sql injection
6.3
CVE-2026-114251
itsourcecode Sales-and-Inventory-System cust_del.php sql injection
6.3
CVE-2026-90700
itsourcecode Sales and Inventory System pro_edit1.php sql injection
6.3
CVE-2026-90600
itsourcecode Sales and Inventory System inv_edit1.php sql injection