CVE-2026-87921: Rizwan17 inventory-management-system manage.php update_record sql injection
A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function updaterecord of the file includes/manage.php. The manipulation of the argument updatecategory/cid/updatebrand/updateproduct leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue can be exploited remotely and requires no privileges or user interaction according to the supplied vector. A publicly available exploit may make exploitation more likely.
Which inputs should defenders focus on when assessing exposure?
The affected update_record function in includes/manage.php processes the update_category, cid, update_brand, and update_product arguments. Systems exposing functionality that reaches this code path should be treated as potentially affected.
Are fixed or affected version numbers available?
No. The project uses a rolling release model, so affected and updated release versions cannot be specified. The affected code is identified as being present up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f.
Has the project provided a remediation response?
The project was notified through an issue report but had not responded at the time of the supplied information. No vendor-provided fix or workaround is described.