Campcodes Complete Sales and Inventory System login page SQL injection

Attackers can sneak commands into the login screen to peek at or change data.

Summary

The login page (/ahira/login.php) of Campcodes Complete Sales and Inventory System with Credit Management 1.0 lets a remote attacker inject SQL commands by manipulating the branch argument. Exploit code has been made public.

What to do

We have not confirmed a fixed version yet. Check the source links below.

Products and platforms

Complete Sales and Inventory System with Credit Management

CVE IDs

CVE-2026-122050 (opens in a new tab)

Sources

Write-up: vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · tracexlabs.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 23:30 UTC

First seen 2026-11-09 16:20 UTC