Inventory System CVE-2026-11518

The attacker must be able to reach the /users.php endpoint over the network (AV:N) - the application is PHP/MySQL-based and typically HTTP-exposed. The submission of the malicious payload requires no authentication (PR:N confirmed by CVSS vector), meaning any network-reachable party can plant the payload. Exploitation requires that a separate victim user - most likely an administrator - subsequently loads /users.php in their browser (UI:R); the attack does not complete without this interaction. Factors limiting exploitation: (1) the victim must actively navigate to the User Management Page, which is an admin function and not visited by all users; (2) the application scope is unchanged (S:U), so the XSS cannot directly pivot to other origins; (3) this product is typically deployed in small-business or educational contexts, reducing the total addressable attack surface. Non-default or special configuration is not required - the vulnerable parameters are core user management fields present in the default application.

The CVSS base score of 4.3 (Medium) reflects the low integrity-only impact (I:L) and required user interaction (UI:R), which mechanically suppresses the score. However, several signals warrant elevating the practical risk assessment. First, PR:N (no privileges required) means the injection step is open to unauthenticated attackers - the barrier to planting the payload is zero. Second, a public PoC (GitHub repository) exists, confirmed by VulDB and the CVSS temporal modifier E:P (Proof of Concept), meaning exploitation requires minimal skill. Third, the target of the XSS execution is the User Management Page, strongly suggesting the victim is an administrative user whose compromised session would grant full application control. EPSS data was not provided in the input - exploitation probability cannot be quantified from available signals. The CVSS Remediation Level modifier RL:X indicates no remediation level has been defined, consistent with the absence of a vendor patch. The RC:R (Reasonable Confidence) temporal modifier confirms the vulnerability is credibly established but not yet vendor-acknowledged with a fix. Net assessment: higher real-world priority than CVSS 4.3 implies, due to unauthenticated write path and admin-targeted payload execution.

An unauthenticated external attacker submits a crafted HTTP POST request to /users.php with a fullname or username value containing a JavaScript payload (e.g., a session cookie-stealing script). The payload is stored in the application database without sanitization. When an administrator next logs in and navigates to the User Management Page to manage users, the stored payload executes in their browser, exfiltrating their session token to an attacker-controlled server. A public PoC demonstrating this stored XSS technique is available at https://github.com/Xmyronn/Stored-XSS-in-Inventory-System-using-PHP-and-MySQL.git.