CVE-2026-87922: medium-severity vulnerability in Rizwan17 inventory-management-system
Rizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authentication
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.7%
A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument userid results in missing authentication. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
Rizwan17 · inventory-management-systempublic PoCs found — 1
cve_referencegithub.com/Rizwan17/inventory-management-system/issues/10unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Rizwan17 inventory-management-system
In the same product, most dangerous first.
CVE-2026-87924MEDIUMRizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authenticationEPSS 0.8%CVE-2026-90565MEDIUMRizwan17 inventory-management-system dashboard.php access controlEPSS 0.5%CVE-2026-90566MEDIUMRizwan17 inventory-management-system Registration register.php createUserAccount improper authorizationEPSS 0.5%CVE-2026-87926MEDIUMRizwan17 inventory-management-system Login Page index.php cross site scriptingEPSS 0.5%CVE-2026-87923MEDIUMRizwan17 inventory-management-system List DBOperation.php cross site scriptingEPSS 0.5%CVE-2026-87925MEDIUMRizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injectionEPSS 0.4%