Is there a public PoC exploit available for CVE-2026-87925?

Yes, a public proof-of-concept exploit is available for CVE-2026-87925. Prioritise patching immediately. EPSS: 0.3%.

Inventory Management System CVE-2026-87925

Q: What is the CVSS score of CVE-2026-87925?

CVE-2026-87925 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-75219 MEDIUM

SQL Injection (CWE-89)

2026-09-09 VulDB

GHSA-jgf4-gc7v-8wx2

PHP SQLi Inventory Management System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated SQLi with no user interaction; limited partial impact across CIA consistent with CVSS 4.0 VC:L/VI:L/VA:L rating.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Sep 10, 2026 - 00:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Sep 09, 2026 - 23:50 vuln.today

CVE Published

Sep 09, 2026 - 23:15 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument pro_name[] results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in Rizwan17's inventory-management-system allows unauthenticated remote attackers to manipulate database queries via the pro_name[] array parameter in the storeCustomerOrderInvoice function of includes/manage.php. The CVSS 4.0 vector (PR:N/AC:L/AT:N) confirms no authentication is required and exploitation is straightforward. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No authentication required - the CVSS 4.0 vector specifies PR:N/UI:N, confirming the endpoint is reachable by unauthenticated remote users. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 6.9 (Medium) reflects network-accessible, unauthenticated, low-complexity exploitation with limited impact across all three pillars (VC:L/VI:L/VA:L), indicating partial rather than full database compromise - attackers can read or modify some data but full database dump or system-level access is not directly implied by the score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch is available at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.