Inventariobasico CVE-2026-118585

Exploitation requires the attacker to hold a valid low-privileged account (PR:L) that can reach the Add Product page and submit the 'product name' field in addlist.php, and it additionally requires a victim to view the page where the payload renders (UI:P) - the script does not fire without that interaction. These two factors (required authentication plus required victim interaction) are the primary limiters on real-world risk. Because the project is a rolling release with no response to the reported issue, no fixed version is available, so there is no patched build to move to as a complete remediation per the available evidence.

This is a medium-severity stored/reflected cross-site scripting flaw (CWE-79) in the 'product name' argument of addlist.php on the Add Product page of configuroweb inventariobasico, a small open-source PHP inventory application. The single provided scoring signal is a CVSS 4.0 vector (5.1) with AV:N/AC:L/AT:N/PR:L/UI:P, meaning network-reachable, low attack complexity, but requiring low-level authentication (PR:L) AND victim interaction (UI:P); impact is limited to integrity of the vulnerable system (VI:L) with no confidentiality or availability impact claimed. No EPSS score and no KEV status were supplied, and the product is not in CISA KEV, so there is no evidence of active exploitation - exploitation status is best described as a public PoC reference existing but not verified as working exploit code. The SSVC/decision signal from the source (vuln.today 'this_month') and the E:P (Proof-of-Concept) exploit maturity both point to a non-urgent, moderate priority rather than an emergency. Net assessment: a real but low-urgency issue - the authentication requirement, required user interaction, limited (integrity-only, low) impact, and the product's obscurity all substantially reduce real-world risk below what the CWE class alone might suggest. Note a minor inconsistency to verify: the vendor-supplied 4.0 vector marks confidentiality VC:N, which is unusual for XSS (session/cookie theft typically implies some confidentiality impact) - treat the impact scoping as vendor-reported rather than independently confirmed.

A low-privileged authenticated user of the inventory application submits a product via addlist.php with a JavaScript payload in the product-name field, which is stored/reflected without proper encoding. When another user (e.g., an administrator or staff member) views the resulting product listing, the script executes in their browser session. A public PoC reference exists as a GitHub issue but is not verified as working exploit code, and exploitation still depends on the victim viewing the malicious entry (UI:P).