The CVSS 7.3 score for CVE-2026-78171 materially understates the actual risk. This is not a typical web vulnerability — it is SQL injection in processlogin.php, the authentication endpoint of a Sales and Inventory System. Successful exploitation doesn't require chaining vulnerabilities or establishing footholds; it grants attackers immediate authenticated access to whatever customer records, supplier pricing, transaction histories, and operational data that system manages. CVSS treats authenticated access as its impact endpoint. It isn't. An inventory system is a horizontal data aggregator by design — once inside, an attacker has everything without pivoting.
The 7.3 score also assumes a patch is coming. It likely isn't. The '1.0' versioning on this product indicates abandonment — there is no itsourcecode development team issuing security fixes. The exposure window is structurally infinite: no vendor patch will arrive, and many deployments are likely in small business environments without dedicated security staff to implement workarounds. You are looking at WAF rules, parameterized query wrappers, or platform migration as the only remediation paths.
Compounding this, the vulnerability almost certainly exists identically across dozens or hundreds of deployments. This is ecosystem failure, not an isolated defect — the same authentication code propagated across template-based deployments means identical blast radius in every environment running this product. Assume active exploitation. Public exploit disclosure in a login-form SQL injection against a business-critical system with no vendor patch is the combination that threat actors prioritize. Prioritize containment and migration accordingly.