Vulnerability · Published Sep 3, 2026 · Assigned by VulDB
CVE-2026-85205itsourcecode Online Medicine Delivery System Wishlist controller.php addwishlist sql injection
Medium 6.3
In plain English
A medium-severity SQL injection in Online Medicine Delivery System from itsourcecode. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 73.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controller.php?action=addwish of the component Wishlist. This manipulation of the argument proid causes sql injection. The attack may be initiated remotely.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| itsourcecode | Online Medicine Delivery System | 1.0 |
Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R
References
- VDB-398414 | itsourcecode Online Medicine Delivery System Wishlist controller.php addwishlist sql injection vdb-entry, technical-description
- VDB-398414 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-85205 | CVE Analysis and Report third-party-advisory
- Submit #892993 | itsourcecode Online Medicine Delivery System v1.0 SQL Injection third-party-advisory
- https://github.com/boyslikesports/202607_vul_dir/blob/main/H-02-SQLi-Wishlist-Update-Insert_en.md patch
- https://itsourcecode.com/ product