CVE-2026-3793

2.1 lowEPSS 0.4%

Low (2.1) in ahsanriaz26gmailcom sales and inventory system. EPSS 0.4% chance of exploitation in the next 30 days.

A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file sales_invoice1.php of the component GET Parameter Handler. This manipulation of the argument sellid causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWEs: CWE-89, CWE-74
Published: 2026-03-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ahsanriaz26gmailcom:sales_and_inventory_system

References

https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-SalesInvoice1-sellid.md
https://vuldb.com/?ctiid.349760
https://vuldb.com/?id.349760
https://vuldb.com/?submit.768048
https://www.sourcecodester.com/

Check your stack JSON