Simple Inventory System CVE-2026-76990

No special conditions are required for exploitation - the affected endpoint /delete.php is accessible remotely with no authentication (CVSS PR:N, UI:N). The application must simply be network-reachable. Exploitation is limited by the partial impact scope (VC:L/VI:L/VA:L in CVSS 4.0), meaning database access is constrained rather than full administrative compromise in a default scenario; actual data exposure depends on the database user privileges configured for the PHP application. Non-default conditions that could expand impact: if the database account runs with elevated privileges (e.g., MySQL root), full database read/write/drop becomes possible. The attack does not require a specific non-default configuration to trigger the injection itself.

The CVSS 4.0 base score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects a low-complexity, unauthenticated, network-reachable attack with partial confidentiality, integrity, and availability impact. The E:P supplemental metric confirms a publicly available proof-of-concept, elevating practical urgency beyond what the base score alone conveys. There is no KEV listing, so confirmed active exploitation in the wild is not established - but the combination of no-auth network access, public exploit code, and a trivially automated attack class (SQLi in a single parameter) means the effective exploitation risk is higher than the moderate base score implies. The product is a small PHP inventory application likely deployed by small businesses or educational institutions rather than enterprise environments, which limits blast radius per deployment but also means these operators typically lack mature patch management. No EPSS score was provided in the input data; that signal is therefore absent from this assessment.

An attacker sends a crafted HTTP GET or POST request to /delete.php with a manipulated ID parameter containing SQL injection payloads (e.g., ' OR 1=1--). Because no authentication is required and the parameter is not sanitized, the injected SQL modifies or extracts data from the backend database. A public proof-of-concept advisory on GitHub documents this exact technique, meaning the attack is reproducible with minimal skill.