Is CVE-2026-9446 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9446 being exploited in the wild.

How severe is CVE-2026-9446?

Medium severity, with a CVSS score of 4.7, published 25 May 2026.

Is there a fix for CVE-2026-9446?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9446 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9446?

Check whether you run SourceCodester Simple POS and Inventory System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9446: SourceCodester Simple POS and Inventory System SQL injection in edit_customer.php

CVE-2026-9446 · Severity: medium · CVSS 4.7 · Published 2026-05-25

SourceCodester Simple POS and Inventory System is a web-based application used for managing retail sales and stock. A security vulnerability in the customer and supplier management modules allows an attacker with administrative access to manipulate database queries. This can lead to unauthorized modification of other user accounts, including the primary administrator, potentially resulting in a full takeover of the system and its data.

Technologies: SourceCodester Simple POS and Inventory System. Vendors: SourceCodester.

Quick answers

Is CVE-2026-9446 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9446 being exploited in the wild.
How severe is CVE-2026-9446?: Medium severity, with a CVSS score of 4.7, published 25 May 2026.
Which products and versions are affected?: SourceCodester Simple POS and Inventory System 1.0.
Is there a fix for CVE-2026-9446?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9446 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9446?: Check whether you run SourceCodester Simple POS and Inventory System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A chained vulnerability exists in SourceCodester Simple POS and Inventory System 1.0 within /admin/edit_customer.php and /admin/edit_supplier.php. The application fails to sanitize the 'id' GET parameter and various POST parameters before concatenating them into SQL UPDATE statements, leading to SQL injection. Additionally, the application lacks proper authorization checks (IDOR), allowing an authenticated user to modify any record by changing the 'id' parameter. An attacker can exploit this to overwrite the administrator's credentials or extract sensitive data from the database. The vulnerability is currently unpatched, and public exploits are available.

Affected products

SourceCodester Simple POS and Inventory System 1.0

Timeline

2026-04-26: disclosed: Initial discovery and PoC published on GitHub gist
2026-05-25: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.