Vulnerability · Published Aug 20, 2026 · Assigned by VulDB
CVE-2026-76785amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection
Medium 6.3
In plain English
A medium-severity SQL injection in Mini-Inventory-and-Sales-Management-System from amirsanni. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Official description
A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file application/models/Transaction.php. Performing a manipulation of the argument orderBy/orderFormat results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| amirsanni | Mini-Inventory-and-Sales-Management-System | 0.1 |
Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-393250 | amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection vdb-entry, technical-description
- VDB-393250 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-76785 | CVE Analysis and Report third-party-advisory
- Submit #879829 | amirsanni Mini-Inventory-and-Sales-Management-System 0.1 SQL Injection third-party-advisory
- https://github.com/amirsanni/Mini-Inventory-and-Sales-Management-System/issues/101 exploit, issue-tracking
- https://github.com/amirsanni/Mini-Inventory-and-Sales-Management-System/ product