CVE-2026-100904
LowCVSS 3.5Summary
A cross-site scripting (XSS) vulnerability was found in mini-inventory-and-sales-management-system in the Items.php file. Manipulating the itemName argument allows remote attack. The exploit is publicly available.
Risk Assessment
An attacker can inject malicious scripts that execute in the user's browser, potentially leading to session theft or other attacks. The public exploit increases risk.
Recommendation
Update the system to the latest version if available, or apply patches. Also consider input validation and sanitization.
Other vulnerabilities in mini-inventory-and-sales-management-system
See all- CVE-2026-100887Medium
A SQL injection vulnerability was found in Mini-Inventory-and-Sales-Management-System in the order_by function. Manipulating the orderBy argument allows remote attack. The exploit is public. The project is no longer maintained.
- CVE-2026-76785Medium
A security flaw has been discovered in Mini-Inventory-and-Sales-Management-System 0.1. The function Transaction::getAll in application/models/Transaction.php is affected. Manipulation of the orderBy/orderFormat arguments results in SQL injection, and the attack can be initiated remotely. The exploit has been publicly released.
Original NVD description (English source)
A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is an unknown function of the file application/controllers/Items.php of the component Items Management Module. The manipulation of the argument itemName leads to cross site scripting. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS