Performance Indicator System CVE-2026-116062

Exploitation requires sending a request to the specific endpoint /opils/staff/save_profile.php with a malicious value in the 'Contact' parameter. The CVSS vector indicates no special configuration, no user interaction, and no privileges are required (PR:N), so against a default deployment reachable over the network it would be remotely exploitable. The key LIMITING factors are: (1) the endpoint resides under a 'staff' path, which in many applications implies an authenticated backend area - the available sources do not confirm whether authentication is enforced, so PR:N is unverified; (2) impact is rated Low across confidentiality, integrity, and availability, limiting the attacker to partial database access rather than full compromise; (3) the affected software is Performance Indicator System 1.0, a niche SourceCodester application unlikely to be exposed in production environments.

This is a moderate-severity SQL injection (CWE-89) with a mixed signal profile that points to a genuine but non-emergency issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a low-complexity, remotely reachable flaw with no stated privileges or user interaction, but all impact metrics are only Low (VC:L/VI:L/VA:L, no subsequent-system impact), which is why the base score lands at 6.9 rather than critical. The vuln.today decision label is 'this_month' (not act_now/emergency), and there is NO CISA KEV listing and NO EPSS score supplied, so there is no evidence of active or widespread exploitation. A public PoC reference exists but is not verified as working exploit code, so this signal must not be treated as confirmed active exploitation. The record originates from a single source (VulDB), and these SourceCodester proof-of-concept applications have an extremely small real-world footprint, so the practical risk is far lower than the 'network/unauthenticated' vector alone would suggest. Caveat: the vulnerable endpoint path (/opils/staff/save_profile.php) sits under a 'staff' area, which implies the PR:N (unauthenticated) metric may be optimistic - the description does not state whether authentication is actually required, so the true privilege prerequisite should be verified against the application.

A remote attacker submits a crafted value in the 'Contact' parameter to /opils/staff/save_profile.php, injecting SQL that the application concatenates into a database query without sanitization. Given the Low impact ratings, this likely allows limited extraction or tampering of database contents (e.g., staff/profile records) rather than full database compromise. A public PoC reference exists but is not verified as working exploit code, so a functional exploit may still require adaptation.