CVE-2026-4781 | SourceCodester Sales and Inventory System 1.0 HTTP GET Parameter update_purchase.php sid sql injection

A vulnerability described as critical has been identified in SourceCodester Sales and Inventory System 1.0. The affected element is an unknown function of the file update_purchase.php of the component HTTP GET Parameter Handler. Executing a manipulation of the argument sid can lead to sql injection.

This vulnerability appears as CVE-2026-4781. The attack may be performed from remote. In addition, an exploit is available.