EUVD-2026-68369
GHSA-x5mg-534m-v2p5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible file with no authentication or interaction required; only partial confidentiality impact, no integrity or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been published and may be used.
AnalysisAI
Direct remote access to an unprotected SQL database backup file in code-projects Simple Inventory System 1.0 allows unauthenticated attackers to retrieve the full contents of the inventory database without any credentials or user interaction. The file inventorymanagement.sql is stored within the web-accessible directory and is directly downloadable via HTTP. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond network access to the web server hosting the application. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 reflects the zero-authentication, network-accessible nature of this disclosure, with exploit maturity flag E:P confirming a publicly available proof-of-concept. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Simple Inventory System
View allSimple Inventory System v1.0 is vulnerable to SQL Injection via /inventory/table_edit_ajax.php. Rated critical severity
Simple Inventory System v1.0 is vulnerable to SQL Injection via /inventory/login.php. Rated high severity (CVSS 7.2), th
A vulnerability, which was classified as problematic, was found in SourceCodester Simple Inventory System 1.0. Rated med
SQL injection in code-projects Simple Inventory System 1.0 allows remote unauthenticated attackers to manipulate backend
A vulnerability was determined in CodeAstro Simple Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerab
A vulnerability was found in SourceCodester Simple Inventory System 1.0. Rated medium severity (CVSS 5.3), this vulnerab
A vulnerability was found in SourceCodester Simple Inventory System 1.0. Rated medium severity (CVSS 5.3), this vulnerab
A vulnerability was found in SourceCodester Simple Inventory System 1.0 and classified as critical. Rated medium severit
A vulnerability has been found in SourceCodester Simple Inventory System 1.0 and classified as critical. Rated medium se
Stored cross-site scripting in code-projects Simple Inventory System 1.0 allows remote unauthenticated attackers to inje
SQL injection in SourceCodester Simple Inventory System 1.0 via the uemail parameter in /user.php allows authenticated r
SQL injection in SourceCodester Simple Inventory System 1.0 via the editBrandName parameter in /brand.php allows authent
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today