Mini Inventory System CVE-2026-100904

Requires an authenticated account with at least low privileges on the Mini Inventory and Sales Management System (PR:L) and the ability to submit or edit an item through the Items Management Module, plus victim interaction (UI:P) - a second user must view the page rendering the malicious itemName for the script to fire. There is no unauthenticated path and no default-config remote code trigger; impact is confined to client-side script execution in a victim's browser (integrity-only, VC:N/VA:N). Realistic exposure is further limited by the product's tiny deployment base.

This is a low-to-moderate risk issue that skews toward the 'high-CVSS-number-relative-to-real-impact' side once context is applied. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) scores only 5.1, reflecting a stored/reflected XSS that requires an already-authenticated actor (PR:L) and victim interaction (UI:P), with impact limited to integrity of the vulnerable web system (VI:L) and no confidentiality or availability effect. No EPSS score is provided, the CVE is NOT in CISA KEV, and no public exploit is referenced in the supplied data - the E:X (Exploit Maturity: Not Defined) code in the vector confirms exploitation status was not asserted. SSVC decision framework data is absent. Signals are internally consistent (all point to a modest, authentication- and interaction-gated web flaw), so there is no CVSS-vs-description conflict to flag. The dominant risk-limiting reality is product prevalence: this is an obscure hobby-grade PHP application on GitHub, so even a valid XSS has a very small real-world attack surface. Net: no public exploit identified at time of analysis, and this is a low priority except for the specific few who run this application.

An authenticated low-privilege user of the Mini Inventory and Sales Management System submits an item with a malicious script payload in the itemName field via application/controllers/Items.php. When another user - for example an administrator viewing the item list - loads the affected page, the stored script executes in their browser session, enabling session/cookie theft or actions in their context. No public exploit code is identified in the provided sources, though the flaw is trivially reproducible given the low attack complexity.