CVE-2026-9446

MEDIUM

SourceCodester Simple POS and Inventory System edit_customer.php sql injection

Title source: cna
STIX 2.1

Description

A vulnerability has been found in SourceCodester Simple POS and Inventory System 1.0. The affected element is an unknown function of the file /admin/edit_customer.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-365427 | SourceCodester Simple POS and Inventory System edit_customer.php sql injection
https://vuldb.com/vuln/365427
Signature, Permissions Required signature permissions-required
VDB-365427 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/365427/cti
Third Party Advisory third-party-advisory
Submit #813613 | SourceCodester POS Inventory System 1.0 SQL Iiinjection + IDOR + Weak Passw ord Hashing
https://vuldb.com/submit/813613

Scores

CVSS v3 4.7
EPSS 0.0032
EPSS Percentile 23.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
SourceCodester/Simple POS and Inventory System 1.0
Published May 25, 2026
Tracked Since May 25, 2026