CVE-2026-116062
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A security flaw was found in SourceCodester Performance Indicator System 1.0 affecting /opils/staff/save_profile.php. Manipulating the Contact argument leads to SQL injection. The attack can be launched remotely and a public exploit is available.
Risk Assessment
Unauthorized SQL injection could lead to data leakage or modification in the database. Since the exploit is public, the risk of rapid exploitation is high.
Recommendation
Update the application to a patched version or enforce input validation and parameterized queries for the Contact argument. Until fixed, restrict access to save_profile.php.
Other vulnerabilities in SourceCodester Performance Indicator System
See all- CVE-2026-116061High
A vulnerability was identified in SourceCodester Performance Indicator System 1.0 affecting /opils/staff/edit_dealer.php. Manipulating the Contact argument leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-116060High
A vulnerability was found in SourceCodester Performance Indicator System 1.0 affecting the file /opils/staff/adddealer.php. Manipulating the Contact argument leads to SQL injection. The attack can be launched remotely and a public exploit exists.
- CVE-2026-116055Medium
A vulnerability was detected in SourceCodester Performance Indicator System 1.0. An unknown function of the file /opils/admin/deleteproduct.php is vulnerable to SQL injection through manipulation of the ID argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-108968High
SourceCodester Performance Indicator System 1.0 contains a SQL injection vulnerability in the file /opils/staff/sales_history.php. Manipulation of the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly released.
- CVE-2026-108967High
SourceCodester Performance Indicator System 1.0 contains a SQL injection vulnerability in the file /opils/staff/edit_credit.php. Manipulation of the credit argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly released.
- CVE-2026-108966High
A SQL injection vulnerability was identified in SourceCodester Performance Indicator System 1.0 in the file /opils/staff/product.php. Manipulation of the Category argument allows remote attack. The exploit is publicly available.
- CVE-2026-108965High
A SQL injection vulnerability was found in SourceCodester Performance Indicator System 1.0 in the file /opils/staff/edit_quantity.php. Manipulation of the pqty argument allows remote attack. The exploit has been publicly disclosed.
- CVE-2026-108964High
A SQL injection vulnerability was identified in SourceCodester Performance Indicator System 1.0 in the file /opils/admin/addproduct.php. Manipulation of the prodcategory argument allows remote attack. The exploit has been made public.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php. The manipulation of the argument Contact results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS