CVE-2026-76785

MediumCVSS 6.3/10Last modified Aug 20, 2026

Description

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file application/models/Transaction.php. Performing a manipulation of the argument orderBy/orderFormat results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Aug 20, 2026
Last modified
Aug 20, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-767875.9The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl_updatehub_probe() (subsys/mgmCVE-2026-767888.8The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a sCVE-2026-767898.8The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its reCVE-2026-76797.3A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This impacts the function getAccessToken of the file yudao-module-sCVE-2026-767907.1The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter beCVE-2026-767938.1The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified beforCVE-2026-767944.6MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user withCVE-2026-767957.3A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API EnCVE-2026-767964.0The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequateCVE-2026-767976.3The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading charCVE-2026-767986.3The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report withCVE-2026-767995.3A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/dat