CVE-2026-116055

MediumCVSS 6.3/10Last modified Oct 25, 2026

Description

A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 25, 2026
Last modified
Oct 25, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-1160566.3A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.phCVE-2026-1160576.3A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file apCVE-2026-1160586.3A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. Affected by this issue is the function JuelScriptEngine.eval of the fileCVE-2026-1160607.3A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/addCVE-2026-1160617.3A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opilCVE-2026-1160627.3A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the fiCVE-2026-1160634.7A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manipCVE-2026-1160666.8Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers toCVE-2026-1160678.2Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that letCVE-2026-1160688.8Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenCVE-2026-1160696.5NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server CVE-2026-116077.6Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed wi
CVE-2026-116055: Medium severity, CVSS 6.3 | Vulnix