SECURITYHIGHCVE-2026-116062

CVE-2026-116062: SourceCodester Performance Indicator System SQL Injection

SQL injection in the Contact argument of /opils/staff/save_profile.php in SourceCodester Performance Indicator System 1.0 can be exploited remotely (CVSS 7.3).

Dylan H.

Security Team

October 26, 2026
1 min read
CVE-2026-116062: SourceCodester Performance Indicator System SQL Injection

Affected Products

  • SourceCodester Performance Indicator System 1.0

Summary

CVE-2026-116062 is a SQL injection flaw in SourceCodester Performance Indicator System 1.0. The vulnerable file is /opils/staff/save_profile.php, where manipulating the Contact argument results in injection. The attack may be launched remotely and the exploit has been released publicly.

AttributeValue
CVE IDCVE-2026-116062
CVSS7.3 (High)
TypeSQL Injection (CWE-89)
VectorRemote
AffectedPerformance Indicator System 1.0
PatchNone announced

This is one of three related issues in the same product; see also CVE-2026-116060 and CVE-2026-116061.

Remediation

  1. Remove the application from internet exposure or restrict it by IP.
  2. Place a WAF with SQL injection rules in front of it.
  3. Where you maintain the code, switch to parameterized queries for the Contact input.
  4. Review database logs for unexpected queries.

Sources