CVE-2026-82612

Name of the Vulnerable Software and Affected Versions itsourcecode Online Medicine Delivery System version 1.0

Description A remote SQL injection is possible via the loadResultList() function within the /index.php?q=single-item endpoint of the Product Detail Page component. This occurs when the ID variable is manipulated, allowing an attacker to execute unauthorized database queries.

Recommendations As a temporary workaround, restrict access to the /index.php?q=single-item endpoint or avoid using the ID parameter until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.