CVE-2026-86211
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A SQL injection vulnerability was found in rabindralamsal inventory-management-system 1.0.0 in the file index.php of the Login component. Manipulating the username/password arguments allows remote attack execution. The exploit has been published and may be used.
Risk Assessment
An attacker could gain unauthorized access to the database, potentially leading to data leakage or system compromise.
Recommendation
Apply patches immediately or restrict access to the system, and use parameterized queries.
Related vulnerabilities
- CVE-2026-90888Critical
The LeadSnap WordPress plugin in versions up to 1.25 contains an unauthenticated PHP Object Injection vulnerability.
- CVE-2026-39738Critical
The FunnelKit Automations WordPress plugin in versions up to 3.8.6.1 contains an unauthenticated PHP Object Injection vulnerability.
- CVE-2026-39732Critical
The Transliterator WordPress plugin in versions up to 2.5.13 contains an unauthenticated SQL Injection vulnerability.
- CVE-2026-119526Critical
The ThemeREX Royal Event WordPress theme in versions up to 2.0 contains a deserialization of untrusted data vulnerability allowing object injection.
- CVE-2026-116852Critical
The Widget Options WordPress plugin in versions up to 4.2.5 contains an author-level Remote Code Execution (RCE) vulnerability.
- CVE-2026-116386Critical
The SMS Alert Order Notifications WordPress plugin in versions up to 4.0.2 contains an unauthenticated privilege escalation vulnerability.
- CVE-2026-118697Critical
In JetBrains Toolbox App before 3.9.1 and 3.8.2, and IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermediate certificates. This may allow an attacker to impersonate a trusted component.
- CVE-2026-61826Critical
Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, allowing anonymous callers to perform configuration-mutating operations such as logging out the Plex integration, persisting an attacker-selected API key, binding an attacker-controlled Plex account token, and other `write_config()` operations. Missing OAuth state validation and attacker-controlled server URLs further enable server-side request forgery and credential exposure.
- CVE-2026-112816Critical
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
- CVE-2026-119706Critical
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability. Attackers can send a base64-encoded crafted pickle in serialized_named_tensors to the /update_weights endpoint, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.
Original NVD description (English source)
A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing a manipulation of the argument username/password can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS