CVE-2026-4778

Description

A weakness has been identified in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file update_category.php of the component HTTP GET Parameter Handler. This manipulation of the argument sid causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

References

https://www.sourcecodester.com/

https://vuldb.com/?submit.775171

https://vuldb.com/?id.352796

https://vuldb.com/?ctiid.352796

https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-UpdateCategory-sid.md

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS