Stock Management System CVE-2026-19925

Exploitation requires a valid authenticated session with high-privilege access to the Stock Management System's admin panel, consistent with PR:H in the CVSS 4.0 vector. The vulnerable endpoint /classes/Master.php?f=delete_supplier must be reachable over the network (AV:N). No special non-default configuration is required beyond the attacker holding a high-privilege account. Limiting factors: the PR:H requirement is the critical gating control - unauthenticated attackers cannot reach this vulnerability without first compromising admin credentials. Exploitation is also limited to environments where the Stock Management System is deployed and network-accessible. No user interaction is required once authenticated.

The CVSS 4.0 base score of 2.0 accurately reflects the constrained real-world risk: the vector PR:H confirms that exploitation requires a high-privilege authenticated session, which is a significant limiting factor. The attack complexity is low (AC:L, AT:N), meaning once authenticated, no further bypass is needed. Impact is graded Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), with no subsequent-system impact (SC:N/SI:N/SA:N). The CVSS 4.0 supplemental metric E:P confirms a publicly available exploit, which lowers the skill bar for authenticated insiders or attackers who have already compromised admin credentials. No EPSS data was provided and the CVE is not listed in CISA KEV, indicating no confirmed widespread active exploitation. In practice, the primary threat model is a malicious or compromised administrator exfiltrating or corrupting supplier data - not an unauthenticated remote attacker.

An attacker who has obtained valid high-privilege administrator credentials - whether through phishing, credential stuffing, or lateral movement - navigates to the supplier deletion endpoint and submits a crafted HTTP request with a malicious id parameter such as 1 UNION SELECT username,password,3 FROM users--. The unsanitized value is executed directly by the database, allowing the attacker to exfiltrate credential hashes or manipulate supplier records. A working proof-of-concept is publicly available on GitHub, reducing the technical skill required for this step.