CVE-2026-9446

2.0 lowEPSS 0.3%

A vulnerability has been found in SourceCodester Simple POS and Inventory System 1.0. The affected element is an unknown function of the file /admin/edit_customer.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

Severity

CVSS 4.0

2.0 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

4.7 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-89
Published: 2026-05-25
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

References

https://gist.github.com/c4ttr4ck/599151a2b90c1cd620933c992873c67a
https://vuldb.com/submit/813613
https://vuldb.com/vuln/365427
https://vuldb.com/vuln/365427/cti
https://www.sourcecodester.com/

Check your stack JSON