SECURITYHIGHCVE-2026-116060

CVE-2026-116060: SourceCodester Performance Indicator System SQL Injection

SQL injection in the Contact argument of /opils/staff/adddealer.php in SourceCodester Performance Indicator System 1.0 can be exploited remotely (CVSS 7.3).

Dylan H.

Security Team

October 26, 2026
1 min read
CVE-2026-116060: SourceCodester Performance Indicator System SQL Injection

Affected Products

  • SourceCodester Performance Indicator System 1.0

Summary

CVE-2026-116060 is a SQL injection flaw in SourceCodester Performance Indicator System 1.0. The vulnerable file is /opils/staff/adddealer.php, where manipulating the Contact argument allows injection. The attack can be launched remotely and a public exploit has been disclosed.

AttributeValue
CVE IDCVE-2026-116060
CVSS7.3 (High)
TypeSQL Injection (CWE-89)
VectorRemote
AffectedPerformance Indicator System 1.0
PatchNone announced

Remediation

  1. Remove the application from internet exposure or restrict it by IP.
  2. Place a WAF with SQL injection rules in front of it.
  3. Where you maintain the code, switch to parameterized queries for the Contact input.
  4. Review database logs for unexpected queries.

Sources