PHP CVE-2026-30565

While CVSS scoring data is unavailable, the practical risk profile is elevated due to multiple factors: reflected XSS without authentication barriers presents an attack vector accessible to any remote user; publicly available proof-of-concept code significantly reduces exploitation barriers; and the affected application (Sales and Inventory System) likely processes sensitive business data including supplier information and transaction records. However, reflected XSS typically requires social engineering (victim clicking a malicious link) rather than automated propagation. The absence of CVSS and EPSS data, combined with no CISA KEV confirmation, suggests this is a known vulnerability in a non-critical infrastructure product, yet the combination of public POC availability and low exploitation complexity warrants prompt remediation for organizations using this software.

An attacker crafts a malicious URL embedding JavaScript payload in the 'limit' parameter (e.g., view_supplier.php?limit=<script>alert('XSS')</script>) and sends it to a logged-in user via phishing email or social engineering. When the user clicks the link, the application reflects the payload in the response without sanitization, causing the browser to execute the attacker's script in the user's session context. The attacker can then steal session tokens, redirect the user to a malicious site, or modify supplier records. Publicly available exploit code from GitHub lowers the technical barrier, enabling attackers without advanced security expertise to weaponize this vulnerability.