CVE-2026-4778

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A weakness has been identified in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file update_category.php of the component HTTP GET Parameter Handler. This manipulation of the argument sid causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Mar 24, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-477806.9free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscripCVE-2026-477818.4PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from aCVE-2026-477824.6Android App "RoboForm Password Manager" provided by Siber Systems, Inc. handles Android intents without sufficient URL validation, user confCVE-2026-477838.1In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon aCVE-2026-477848.1In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by saslCVE-2026-477869.3An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attCVE-2026-47798.8A security vulnerability has been detected in SourceCodester Sales and Inventory System 1.0. This issue affects some unknown processing of tCVE-2026-477906.3A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can thCVE-2026-47808.8A vulnerability was detected in SourceCodester Sales and Inventory System 1.0. Impacted is an unknown function of the file update_out_standiCVE-2026-47818.8A flaw has been found in SourceCodester Sales and Inventory System 1.0. The affected element is an unknown function of the file update_purchCVE-2026-47826.5The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_getCVE-2026-478258.6Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. Th