CVE Alert: CVE-2026-116060 – SourceCodester

A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. Executing a manipulation of the argument can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

**Risk verdict:** Treat this as a high-priority exposure to validate and contain promptly: remote exploitation appears straightforward and public exploit information is available, but KEV and SSVC status are not supplied.

**Why this matters:** An attacker may be able to tamper with database queries without an account, potentially exposing or altering records or disrupting service. Realistic goals include harvesting business or staff data, changing operational records, and using the application as an initial foothold; the assessed impact is limited to the application’s own security boundary.

**Most likely attack path:** An attacker sends crafted input to the affected web function over the network; the metrics indicate low complexity, no privileges, and no user interaction are required. Scope is unchanged, so direct impact is expected within the application rather than automatically extending to other systems, although stolen credentials or trusted integrations could enable follow-on access.

**Who is most exposed:** Organisations running this application on publicly reachable web servers are most at risk, particularly deployments using default or weak database permissions.

Review web and application logs for malformed or unusually long ` ` values and SQL syntax.

Check database audit logs for unexpected queries, errors, reads, or writes associated with the application account.

Look for unusual outbound traffic or web-server child processes around suspicious requests.

Mitigation and prioritisation:

Confirm exposure and whether a vendor fix exists; apply a verified update or code-level remediation.

Use parameterised queries and restrict the application database account to necessary permissions.

Restrict public access to the affected function where feasible; test changes before deployment.

Check KEV, SSVC, and EPSS status, which are absent here, before final queue placement.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.