CVE-2026-9445

Deferred Deferred - Pending Action

Unrestricted File Upload in Simple POS and Inventory System

Publication date: 2026-05-25

Last updated on: 2026-05-25

Assigner: VulDB

Description

A flaw has been found in SourceCodester Simple POS and Inventory System 1.0. Impacted is an unknown function of the file /admin/addproduct.php of the component File Extension Handler. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-25

Last Modified

2026-05-25

Generated

2026-07-06

AI Q&A

2026-05-26

EPSS Evaluated

2026-07-04

NVD

CVE-2026-9445

EUVD

EUVD-2026-31656

Affected Vendors & Products

Vendor	Product	Version / Range
sourcecodester	simple_pos_and_inventory_system	1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the SourceCodester Simple POS and Inventory System 1.0, specifically in the file /admin/addproduct.php within the File Extension Handler component. It involves manipulation of the 'image' argument, which allows an attacker to upload files without restriction.

Because the upload is unrestricted, a remote attacker can exploit this flaw to upload potentially malicious files to the system.

The exploit for this vulnerability has already been published, increasing the risk of it being used in attacks.

Impact Analysis

This vulnerability can allow a remote attacker to upload arbitrary files to the affected system without restriction.

Such unauthorized file uploads can lead to further compromise, including execution of malicious code, data breaches, or disruption of service.

The impact includes potential loss of confidentiality, integrity, and availability of the system and its data.

Hi! I’m here to help you understand CVE-2026-9445. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70