SECURITYHIGHCVE-2026-116061

CVE-2026-116061: SourceCodester Performance Indicator System SQL Injection

SQL injection in the Contact argument of /opils/staff/edit_dealer.php in SourceCodester Performance Indicator System 1.0 can be exploited remotely (CVSS 7.3).

Dylan H.

Security Team

October 26, 2026
1 min read
CVE-2026-116061: SourceCodester Performance Indicator System SQL Injection

Affected Products

  • SourceCodester Performance Indicator System 1.0

Summary

CVE-2026-116061 is a SQL injection flaw in SourceCodester Performance Indicator System 1.0. The vulnerable file is /opils/staff/edit_dealer.php, where manipulating the Contact argument leads to injection. The attack may be initiated remotely and the exploit is publicly available.

AttributeValue
CVE IDCVE-2026-116061
CVSS7.3 (High)
TypeSQL Injection (CWE-89)
VectorRemote
AffectedPerformance Indicator System 1.0
PatchNone announced

This is one of three related issues in the same product; see also CVE-2026-116060 and CVE-2026-116062.

Remediation

  1. Remove the application from internet exposure or restrict it by IP.
  2. Place a WAF with SQL injection rules in front of it.
  3. Where you maintain the code, switch to parameterized queries for the Contact input.
  4. Review database logs for unexpected queries.

Sources