Is there a public PoC exploit available for CVE-2026-82540?

Yes, a public proof-of-concept exploit is available for CVE-2026-82540. Prioritise patching immediately. EPSS: 0.2%.

Sales and Inventory System CVE-2026-82540

Q: What is the CVSS score of CVE-2026-82540?

CVE-2026-82540 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-68184 LOW

SQL Injection (CWE-89)

2026-08-30 VulDB

GHSA-q78f-c32r-53f2

PHP SQLi Sales And Inventory System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-accessible SQL injection requires a low-privilege authenticated session; no scope change; partial CIA impact consistent with database record access.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVE Published

Aug 31, 2026 - 10:50 cve.org

LOW 2.1

Severity Changed

Aug 30, 2026 - 12:22 NVD

MEDIUM LOW

CVSS changed

Aug 30, 2026 - 12:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 30, 2026 - 11:45 vuln.today

DescriptionCVE.org

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_searchfrm.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/cust_searchfrm.php customer search endpoint to database manipulation via an unsanitized ID parameter. Authenticated remote attackers with low-privilege access can alter backend SQL queries to read, modify, or delete customer and inventory records. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid authenticated session with at least low-privilege access to the itsourcecode Sales and Inventory System - the CVSS 4.0 PR:L metric confirms authentication is mandatory, meaning unauthenticated external actors cannot exploit this directly. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) reflects moderate severity: network-accessible, low-complexity exploitation limited by a low-privilege authentication requirement and partial impact across confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.