CVE-2026-9444

MEDIUM

SourceCodester Simple POS and Inventory System GET Parameter deleteproduct.php delete sql injection

Title source: cna
STIX 2.1

Description

A vulnerability was detected in SourceCodester Simple POS and Inventory System 1.0. This issue affects the function delete of the file /admin/deleteproduct.php of the component GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-365425 | SourceCodester Simple POS and Inventory System GET Parameter deleteproduct.php delete sql injection
https://vuldb.com/vuln/365425
Signature, Permissions Required signature permissions-required
VDB-365425 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/365425/cti
Third Party Advisory third-party-advisory
Submit #813611 | SourceCodester POS Inventory System 1.0 SQL Injection (Error-Based / UNION-Based)
https://vuldb.com/submit/813611

Scores

CVSS v3 4.7
EPSS 0.0032
EPSS Percentile 23.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
SourceCodester/Simple POS and Inventory System 1.0
Published May 25, 2026
Tracked Since May 25, 2026