CVE-2026-10172
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Vulnerability in Bdtask Multi-Store Inventory Management System 1.0 allows unrestricted file upload by manipulating the module argument in the Upload function of the file application/modules/dashboard/controllers/Module.php.
Risk Assessment
An attacker can remotely upload malicious files to the server, potentially leading to code execution, system compromise, or data theft.
Recommendation
Immediately upgrade the system to the latest version or implement restrictions on file types and input validation.
Other vulnerabilities in Bdtask Multi-Store Inventory Management System
See all- CVE-2026-10155Medium
Vulnerability in Bdtask Multi-Store Inventory Management System 1.0 allows SQL Injection by manipulating the dtpToDate argument in the accounts_report_search function of the file application/modules/accounts/controllers/Accounts.php.
- CVE-2020-36012Medium
A stored XSS vulnerability was found in BDTASK Multi-Store Inventory Management System 1.0. A local admin can inject arbitrary JavaScript code via the Customer Name field.
Original NVD description (English source)
A security flaw has been discovered in Bdtask Multi-Store Inventory Management System 1.0. The affected element is the function Upload of the file application/modules/dashboard/controllers/Module.php of the component Component Module. The manipulation of the argument module results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.