inventory-management-system CVE-2026-86211

No special conditions are required for exploitation. The vulnerability exists in the default login form of index.php, which is the application entry point accessible to any unauthenticated user. The application must be network-reachable (AV:N), but no authentication, specific configuration, or user interaction is needed. Limiting factors: the application is a niche PHP project with a small deployment footprint, so mass exploitation is unlikely; however, any single internet-facing deployment is immediately vulnerable without additional controls.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated, low-complexity, remotely accessible exploitation with no user interaction required - a worst-case access profile. The supplier-assigned impact is conservatively rated VC:L/VI:L/VA:L, which likely reflects narrow PoC scope rather than the full exploitation ceiling: login-page SQL injection canonically enables authentication bypass and full database read/write access, suggesting real-world impact is likely higher than the assigned score. The E:P exploit-existence flag in the CVSS 4.0 vector aligns with the confirmed public PoC on GitHub. No KEV listing exists, so active exploitation in the wild has not been confirmed. EPSS data is not provided; however, the combination of public exploit code, zero-privilege requirement, and trivial attack complexity makes automated or opportunistic scanning likely. The product is an obscure, single-developer PHP application, limiting overall exposure, but any internet-facing deployment is immediately at risk.

An attacker scans for internet-exposed instances of this inventory system, submits a crafted username such as ' OR '1'='1' -- to index.php, and bypasses the login check entirely to gain administrative access to the inventory dashboard. Because a public proof-of-concept is available on GitHub, this step can be trivially reproduced by script kiddies with no vulnerability research skills. From inside the application, the attacker can enumerate and exfiltrate the full database, including user credentials and inventory records.