CVE-2026-9445

MediumCVSS 6.3/10Last modified Jul 20, 2026

Description

A flaw has been found in SourceCodester Simple POS and Inventory System 1.0. Impacted is an unknown function of the file /admin/addproduct.php of the component File Extension Handler. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284CWE-434

Affected software

No affected versions have been published.

Timeline

Published
May 25, 2026
Last modified
Jul 20, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-944507.5Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to causeCVE-2026-944516.5Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpointCVE-2026-944537.5Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another paCVE-2026-944557.1An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleCVE-2026-944569.1Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used CVE-2026-944574.8Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.CVE-2026-94464.7A vulnerability has been found in SourceCodester Simple POS and Inventory System 1.0. The affected element is an unknown function of the filCVE-2026-944616.5Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.CVE-2026-944627.1Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associCVE-2026-94477.3A vulnerability was found in SourceCodester Simple POS and Inventory System 1.0. The impacted element is an unknown function of the file /usCVE-2026-94484.3A vulnerability was determined in code-projects Employee Management System 1.0. This affects an unknown function of the file /applyleave.phpCVE-2026-944828.2Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App
CVE-2026-9445: Medium severity, CVSS 6.3 | Vulnix