CVE-2026-5561

MediumCVSS 6.3/10Last modified Jul 24, 2026

Description

A vulnerability was determined in Campcodes Complete POS Management and Inventory System up to 4.0.6. This affects an unknown function of the file app/Http/Controllers/SettingsController.php of the component Environment Variable Handler. Executing a manipulation can lead to injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-707

Affected software

No affected versions have been published.

Timeline

Published: Apr 5, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-556108.7InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to CVE-2026-556110.0AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.11.1 unti CVE-2026-556159.2Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.5, Neo4jChatAgent passes LLM-generated CVE-2026-556176.9Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj CVE-2026-556186.5eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed informa CVE-2026-556195.3eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed informa CVE-2026-55629.8A vulnerability was identified in provectus kafka-ui up to 0.7.2. This impacts the function validateAccess of the file /api/smartfilters/tes CVE-2026-556207.5eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed informa CVE-2026-556217.7Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copyin CVE-2026-556227.7Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying whe CVE-2026-556245.3MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8, players can take ite CVE-2026-556254.9GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material