Performance Indicator System CVE-2026-116055

Exploitation requires authenticated access to the admin interface: the vulnerable endpoint is /opils/admin/deleteproduct.php and the CVSS vector specifies PR:L, so the attacker must hold valid (low-privilege) credentials to the admin area. Within that context there is no user interaction requirement (UI:N) and the attack is remote over the network (AV:N/AC:L) by supplying a malicious ID parameter. The primary limiting factor is that admin authentication gates the vulnerable function, which narrows exposure to users who can already reach and log into the admin panel of Performance Indicator System 1.0.

This is a medium-severity, lower-priority issue rather than an urgent one, and the signals are internally consistent. The only CVSS vector supplied is CVSS 4.0 (base 5.3) with AV:N/AC:L/PR:L/UI:N and uniformly Low impacts (VC:L/VI:L/VA:L), plus E:P (Proof-of-Concept exploit maturity). PR:L means exploitation is authenticated - the vulnerable endpoint sits under /opils/admin/, so an attacker needs valid access to the admin area, which substantially limits real-world exposure. It is NOT in CISA KEV, so there is no confirmed active exploitation, and no EPSS probability was provided in the input, so widespread-exploitation likelihood cannot be quantified from the data. A public PoC reference exists (a GitHub issue link) but it is not verified as working exploit code, so this should be treated as PoC-stage, not weaponized. The vuln.today decision label is 'this_month', which matches a patch-in-normal-cycle posture, not an emergency. Net: a genuine authenticated SQL injection worth fixing, but the combination of required privileges, absent KEV/EPSS escalation, unverified PoC, and a very small deployment footprint makes it a routine-priority item, not a high-real-risk emergency.

An attacker who already has access to the application's admin panel sends a crafted value for the ID parameter to /opils/admin/deleteproduct.php, injecting SQL that the backend executes against the database. A public PoC reference exists (not verified as working exploit code), lowering the effort to reproduce; given AV:N/AC:L, the request is a simple remote HTTP call once authenticated.