CVE-2026-10155

MEDIUM

Bdtask Multi-Store Inventory Management System Accounts Report Accounts.php accounts_report_search sql injection

Title source: cna

Description

A vulnerability was found in Bdtask Multi-Store Inventory Management System 1.0. The impacted element is the function accounts_report_search of the file application/modules/accounts/controllers/Accounts.php of the component Accounts Report Handler. Performing a manipulation of the argument dtpToDate results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

References (4)

Core 4

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-367408 | Bdtask Multi-Store Inventory Management System Accounts Report Accounts.php accounts_report_search sql injection

https://vuldb.com/vuln/367408

Signature, Permissions Required signature permissions-required

VDB-367408 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/367408/cti

Third Party Advisory third-party-advisory

Submit #818863 | Bdtask Multi-Store Inventory Management System 1.0 SQL Injection

https://vuldb.com/submit/818863

Exploit exploit

https://github.com/kevin57545/CVE/blob/main/README.md

View Exploit ZIP pw:eip

Scores

CVSS v3 4.7

EPSS 0.0021

EPSS Percentile 10.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-74 CWE-89

Status published

Products (1)

Bdtask/Multi-Store Inventory Management System 1.0

Published May 31, 2026

Tracked Since May 31, 2026