CVE-2026-87922
HighCVSS 7.3Summary
A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument userid results in missing authentication. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Risk Assessment
Risk includes unauthorized access to category addition functionality, potentially leading to unauthorized system changes, data integrity compromise, or further compromise.
Recommendation
Since the project has not responded, consider applying temporary mitigations such as restricting access to the system or implementing additional authentication mechanisms, and monitor for public exploits.
Other vulnerabilities in inventory-management-system
See all- CVE-2026-87924Medium
A security vulnerability in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f affects the file includes/invoice_bill.php in the Invoice Generation component, where manipulation of arguments order_date/invoice_no leads to missing authentication, allowing remote attack.
- CVE-2026-87923Medium
In the inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f, a cross-site scripting vulnerability was found in includes/DBOperation.php of the List Handler component. Manipulation of category_name/brand_name/product_name arguments allows remote attack. The exploit is public, and the project has not responded.
- CVE-2026-87921High
A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function update_record of the file includes/manage.php. The manipulation of the argument update_category/cid/update_brand/update_product leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
Original NVD description (English source)
A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument userid results in missing authentication. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.