CVE-2026-3791

MEDIUM

SourceCodester Sales and Inventory System 1.0 - SQL Injection

Title source: llm
STIX 2.1

Description

A vulnerability has been found in SourceCodester Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file dashboard.php of the component Search. The manipulation of the argument searchtxt leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

References (5)

Core 5
Core References
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.349758
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.349758
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.768046
Various Sources product
https://www.sourcecodester.com/

Scores

CVSS v3 6.3
EPSS 0.0004
EPSS Percentile 11.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
ahsanriaz26gmailcom/sales_and_inventory_system 1.0
Published Mar 09, 2026
Tracked Since Mar 09, 2026