CVE-2026-87923: Rizwan17 inventory-management-system List DBOperation.php cross site scripting
A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is some unknown functionality of the file includes/DBOperation.php of the component List Handler. This manipulation of the argument categoryname/brandname/productname causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What inputs are implicated in the issue?
The affected List Handler functionality in includes/DBOperation.php is vulnerable when category_name, brand_name, or product_name arguments are manipulated.
Can this be exploited remotely without authentication?
Yes. The supplied severity vector indicates network attack access, low attack complexity, no privileges required, and user interaction required. The description also states that the attack can be initiated remotely.
Is there a fixed version to upgrade to?
No affected or updated version details are available because the project uses a rolling release. The project was reportedly notified through an issue report but had not responded.
Is public exploit information available?
Yes. The exploit has been made public and could be used in attacks.