CVE-2026-87924: Rizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication
A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affects an unknown part of the file includes/invoicebill.php of the component Invoice Generation. Such manipulation of the argument orderdate/invoiceno leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instances of Rizwan17 inventory-management-system containing the affected includes/invoice_bill.php Invoice Generation code are exposed. The vulnerable component can be attacked remotely, without prior authentication or user interaction.
What does an attacker need to exploit it?
An attacker can manipulate the order_date and invoice_no arguments handled by includes/invoice_bill.php. The available information indicates low attack complexity and no required privileges.
Are fixed versions available?
No affected or fixed release versions are available because the project uses rolling releases. The project was notified through an issue report but had not responded at the time of disclosure.
How urgent is mitigation if the application is internet-accessible?
Public exploit disclosure has occurred, so internet-accessible deployments should be prioritized for review and mitigation. The reported impact includes unauthorized modification of data and service availability impact.