PT-2026-43029 · Sourcecodester · Simple Inventory System

C4Ttr4Ck · CVE-2026-9444 · Published 2026-05-25 · Updated 2026-05-26

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SourceCodester Simple POS and Inventory System version 1.0

Description An issue exists in the GET Parameter Handler component where the delete() function within the '/admin/deleteproduct.php' endpoint is susceptible to SQL injection. This occurs through the manipulation of the ID argument, allowing a remote attack to be launched.

Recommendations Restrict access to the '/admin/deleteproduct.php' endpoint or avoid using the ID parameter until a fix is applied.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-9444

Affected Products

Simple Inventory System

References · 9

• 🔥 https://gist.github.com/c4ttr4ck/5d05aaee5b43f259ebe8bb8bce5c658f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-9444 · Security Note
• https://vuldb.com/submit/813611 · Note
• https://sourcecodester.com · Note
• https://t.me/CVEtracker/54846 · Telegram Post
• https://twitter.com/muhd_alameenn/status/2059404733282930805 · Twitter Post
• https://vuldb.com/vuln/365425/cti · Note
• https://vuldb.com/vuln/365425 · Note
• https://twitter.com/CVEnew/status/2058935269747831239 · Twitter Post