CVE-2026-87923
MediumCVSS 4.3Summary
In the inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f, a cross-site scripting vulnerability was found in includes/DBOperation.php of the List Handler component. Manipulation of category_name/brand_name/product_name arguments allows remote attack. The exploit is public, and the project has not responded.
Risk Assessment
An attacker can remotely inject malicious scripts, potentially leading to session theft, account takeover, or other attacks on system users.
Recommendation
Apply patches immediately or temporarily restrict access, and validate/sanitize input in DBOperation.php.
Other vulnerabilities in inventory-management-system
See all- CVE-2026-87924Medium
A security vulnerability in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f affects the file includes/invoice_bill.php in the Invoice Generation component, where manipulation of arguments order_date/invoice_no leads to missing authentication, allowing remote attack.
- CVE-2026-87922High
A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument userid results in missing authentication. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
- CVE-2026-87921High
A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function update_record of the file includes/manage.php. The manipulation of the argument update_category/cid/update_brand/update_product leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
Original NVD description (English source)
A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is some unknown functionality of the file includes/DBOperation.php of the component List Handler. This manipulation of the argument category_name/brand_name/product_name causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.