CVE-2026-4777

MEDIUM

SourceCodester Sales and Inventory System POST Parameter view_supplier.php sql injection

Title source: cna
STIX 2.1

Description

A security flaw has been discovered in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file view_supplier.php of the component POST Parameter Handler. The manipulation of the argument searchtxt results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-352795 | SourceCodester Sales and Inventory System POST Parameter view_supplier.php sql injection
https://vuldb.com/?id.352795
Signature, Permissions Required signature permissions-required
VDB-352795 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/?ctiid.352795
Third Party Advisory third-party-advisory
Submit #775169 | SourceCodester Sales and Inventory System 1.0 SQL Injection
https://vuldb.com/?submit.775169

Scores

CVSS v3 6.3
EPSS 0.0024
EPSS Percentile 15.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (2)
ahsanriaz26gmailcom/sales_and_inventory_system 1.0
SourceCodester/Sales and Inventory System 1.0
Published Mar 24, 2026
Tracked Since Mar 25, 2026