CVE-2026-87926: Rizwan17 inventory-management-system Login Page index.php cross site scripting
A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the file index.php of the component Login Page. Executing a manipulation of the argument msg can lead to cross site scripting. The attack can be launched remotely. The exploit has been published and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges, but it requires user interaction. The attacker manipulates the msg argument processed by index.php on the Login Page.
Are affected versions known?
No. The project does not use versioning, so affected and unaffected releases cannot be identified from version information; the issue is reported to affect the project up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f.
Is public exploit information available?
Yes. An exploit has been published and may be used.
Has the project provided a fix or response?
No response from the project is reported after it was informed through an issue report. No fix is identified in the available data.