Is there a public PoC exploit available for CVE-2026-90597?

Yes, a public proof-of-concept exploit is available for CVE-2026-90597. Prioritise patching immediately. EPSS: 0.2%.

Sales and Inventory System CVE-2026-90597

Q: What is the CVSS score of CVE-2026-90597?

CVE-2026-90597 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-77127 LOW

SQL Injection (CWE-89)

2026-09-13 VulDB

GHSA-gx4h-w6xv-9v4j

PHP SQLi Sales And Inventory System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

SQL injection enables full DB read and write (C:H/I:H); PR:L reflects mandatory authentication per CVSS 4.0 input; A:L for limited but possible service disruption via destructive queries.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Sep 13, 2026 - 22:22 NVD

MEDIUM LOW

CVSS changed

Sep 13, 2026 - 22:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Sep 13, 2026 - 22:06 vuln.today

CVE Published

Sep 13, 2026 - 21:30 cve.org

MEDIUM 5.3

DescriptionCVE.org

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/sup_edit1.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/sup_edit1.php endpoint to database manipulation via an unsanitized ID parameter, enabling a low-privileged remote attacker to read or modify arbitrary backend database contents. A publicly available exploit (POC on GitHub) confirms the technique is reproducible with minimal skill. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires possession of at least a low-privileged authenticated session on the itsourcecode Sales and Inventory System instance (PR:L per the CVSS 4.0 vector) - unauthenticated exploitation is not indicated. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The reported CVSS 4.0 score of 5.3 with VC:L/VI:L/VA:L reflects conservative NVD-style scoring but likely understates real database impact: SQL injection in a PHP/MySQL application routinely permits full database extraction - including user credentials, supplier records, and inventory data - and arbitrary data modification, impacts that warrant higher C and I metrics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.