CVE-2026-9445

MEDIUM

SourceCodester Simple POS and Inventory System File Extension addproduct.php unrestricted upload

Title source: cna

Description

A flaw has been found in SourceCodester Simple POS and Inventory System 1.0. Impacted is an unknown function of the file /admin/addproduct.php of the component File Extension Handler. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used.

References (5)

Core 5

Core References

Product product

https://www.sourcecodester.com/

Vdb Entry, Technical Description vdb-entry technical-description

VDB-365426 | SourceCodester Simple POS and Inventory System File Extension addproduct.php unrestricted upload

https://vuldb.com/vuln/365426

Signature, Permissions Required signature permissions-required

VDB-365426 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/365426/cti

Third Party Advisory third-party-advisory

Submit #813612 | SourceCodester POS Inventory System 1.0 SQL Injection + Unrestricted File Upload

https://vuldb.com/submit/813612

Exploit exploit

https://gist.github.com/c4ttr4ck/dd5c36ac4317232be183b7b90139d064

Scores

CVSS v3 6.3

EPSS 0.0033

EPSS Percentile 24.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-284 CWE-434

Status published

Products (1)

SourceCodester/Simple POS and Inventory System 1.0

Published May 25, 2026

Tracked Since May 25, 2026