Is CVE-2026-9444 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9444 being exploited in the wild.

How severe is CVE-2026-9444?

Medium severity, with a CVSS score of 4.7, published 25 May 2026.

Is there a fix for CVE-2026-9444?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9444 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9444?

Check whether you run SourceCodester Simple POS and Inventory System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9444: SourceCodester Simple POS and Inventory System SQL injection in delete scripts

CVE-2026-9444 · Severity: medium · CVSS 4.7 · Published 2026-05-25

SourceCodester Simple POS and Inventory System is a web-based application used by small businesses to manage sales and stock. A security vulnerability in the administrative interface allows an attacker to interfere with the database by sending specially crafted web requests. This could lead to the unauthorized deletion of products, customers, or supplier records, as well as the potential theft of sensitive business data and user credentials.

Technologies: SourceCodester Simple POS and Inventory System. Vendors: SourceCodester.

Quick answers

Is CVE-2026-9444 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9444 being exploited in the wild.
How severe is CVE-2026-9444?: Medium severity, with a CVSS score of 4.7, published 25 May 2026.
Which products and versions are affected?: SourceCodester Simple POS and Inventory System 1.0.
Is there a fix for CVE-2026-9444?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9444 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9444?: Check whether you run SourceCodester Simple POS and Inventory System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in SourceCodester Simple POS and Inventory System 1.0 within the 'id' GET parameter handler used by several administrative scripts, including /admin/deleteproduct.php, /admin/deletecustomer.php, and /admin/deletesupplier.php. The application fails to sanitize the 'id' parameter before concatenating it into SQL queries using mysqli_query(). An authenticated attacker with administrative access can exploit this to perform error-based or UNION-based SQL injection. This allows for the deletion of arbitrary database records, exfiltration of sensitive information such as MD5 password hashes, or potentially remote code execution via 'INTO OUTFILE' if the database user has sufficient privileges. No patch is currently available; users are advised to implement prepared statements and cast input parameters to integers.

Affected products

SourceCodester Simple POS and Inventory System 1.0

Timeline

2026-04-26: disclosed: Initial discovery and PoC published on GitHub Gist
2026-05-25: advisory: CVE published and VulDB entry created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.