Multi-Store Inventory CVE-2026-10155

Q: What is the CVSS score of CVE-2026-10155?

CVE-2026-10155 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33475 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-05-31 cna@vuldb.com

GHSA-xg25-5g7j-67pp

PHP SQLi

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 31, 2026 - 00:27 vuln.today

DescriptionCVE.org

A vulnerability was found in Bdtask Multi-Store Inventory Management System 1.0. The impacted element is the function accounts_report_search of the file application/modules/accounts/controllers/Accounts.php of the component Accounts Report Handler. Performing a manipulation of the argument dtpToDate results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in Bdtask Multi-Store Inventory Management System 1.0 exposes backend database contents through the Accounts Report Handler's date-range search functionality. The vulnerability resides in the accounts_report_search function (Accounts.php), where the dtpToDate argument is passed to a SQL query without sanitization, allowing an authenticated high-privileged user to read, modify, or partially disrupt database data. Publicly available exploit code exists (CVSS 4.0 E:P), though the high-privilege prerequisite significantly limits the realistic attacker population; the vulnerability is not listed in CISA KEV.

Technical ContextAI

The affected application is a PHP-based multi-store inventory management system developed by Bdtask, version 1.0. The vulnerable code follows a CodeIgniter-style MVC pattern, evidenced by the path application/modules/accounts/controllers/Accounts.php. The accounts_report_search function constructs a SQL query incorporating the dtpToDate parameter - a date input submitted via the Accounts Report search form - without applying parameterized queries or input validation. CWE-74 (Injection) covers this root cause class, which encompasses SQL injection arising from unsanitized user-controlled data being embedded directly into SQL statement structure. No CPE string was provided in the source intelligence, so affected version is limited to what is stated in the NVD description: version 1.0 only.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary fix is to rewrite the accounts_report_search function in Accounts.php to use parameterized queries or prepared statements for the dtpToDate argument, eliminating direct interpolation of user input into SQL. As a compensating control, restrict access to the Accounts Report module to the minimum number of administrator accounts necessary, reducing the population of users who could trigger the vulnerable parameter. Additionally, deploying a web application firewall (WAF) rule to detect and block SQL metacharacters in date-format fields can reduce automated exploit success, though this carries a trade-off of potential false positives on legitimate date inputs. Monitor VulDB entry 367408 (https://vuldb.com/vuln/367408) for vendor patch releases.