Simple POS System CVE-2026-9444

Exploitation requires the attacker to be authenticated with high (admin-level) privileges on the Simple POS and Inventory System, as confirmed by PR:H in the CVSS 4.0 vector. The specific vulnerable condition is the admin panel endpoint /admin/deleteproduct.php being accessible and the 'ID' GET parameter being passed to the delete function without sanitization. No special non-default configuration is required beyond having an admin account - any default installation of version 1.0 with the admin panel exposed is vulnerable once admin access is obtained. Exploitation is limited by: (1) the requirement for prior admin authentication, which is itself a significant barrier; (2) SSVC Automatable: no, meaning mass automated scanning is not practical; and (3) impact bounded to Low across CIA on the vulnerable system only, with no scope change to other systems.

The overall risk profile is low despite network reachability. The CVSS 4.0 score of 2.0 reflects the high-privilege prerequisite (PR:H) - an attacker must already hold admin-level credentials to reach the vulnerable endpoint, substantially limiting the attack surface. Impact is scored uniformly Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), with no lateral scope impact (SC:N/SI:N/SA:N). EPSS corroborates this low-risk picture at 0.03% probability of exploitation (8th percentile), indicating minimal observed exploitation activity in the broader threat landscape. The SSVC assessment further confirms: Automatable is 'no' (the high-privilege requirement prevents scripted mass exploitation), and Technical Impact is 'partial'. The publicly available POC (E:P in CVSS 4.0 vector, GitHub gist confirmed) elevates the threat marginally above zero-day ambiguity but does not indicate active campaigns. No CISA KEV listing exists. In aggregate, this is a low-priority finding for organizations running this software - it cannot be exploited without prior admin compromise, which itself represents a more severe event.

An attacker who has obtained admin credentials to the Simple POS and Inventory System - via credential theft, brute force, or insider access - navigates to the /admin/deleteproduct.php endpoint and appends a crafted SQL payload to the 'ID' GET parameter (e.g., ?ID=1' OR 1=1--). Because the value is interpolated directly into an SQL query without sanitization, the injected clause executes against the backend database, enabling unauthorized data enumeration or manipulation. A public POC exists on GitHub confirming this technique is functional against version 1.0.