EUVD-2026-77039
GHSA-8cv5-h88c-pcq8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed dashboard.php instance
-
ExploitCraft request with manipulated userid parameter
-
ExecutionBypass server-side access control check
-
ImpactRetrieve unauthorized user or inventory data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The application must be deployed and reachable over a network (typically HTTP/HTTPS). The vulnerable endpoint is dashboard.php, which must be accessible without prior authentication - or must accept the |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with E:P (exploit proof-of-concept) reflects a remotely reachable, low-complexity attack requiring no privileges and no user interaction. The confidentiality impact is rated Low (VC:L) with no integrity or availability impact, yielding a score of 5.5 - moderate in absolute terms. EPSS data is not provided, but a public exploit in a GitHub issue against a small, unmaintained project makes this a realistic opportunistic target for anyone scanning for exposed dashboards. The absence of a CISA KEV listing and the Low confidentiality impact bound the real-world severity: this is not a system-compromise vector but rather an unauthorized data disclosure risk. The product appears to be a niche open-source project with limited enterprise adoption, which constrains blast radius significantly. The maintainer's non-response to disclosure is a meaningful risk amplifier for anyone currently running this software, as no patch path exists. |
| Exploit ScenarioDerived | An attacker discovers a publicly accessible installation of the inventory-management-system via web search or automated scanning and navigates to dashboard.php. By iterating or guessing |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 13, 2026
Improper access control in Rizwan17's PHP-based inventory-management-system exposes dashboard.php to unauthorized access via manipulation of the userid parameter, allowing remote unauthenticated attackers to access other users' data or bypass authentication controls. The affected codebase is identified by commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f and is distributed as a rolling release with no versioned patch available. A public proof-of-concept exploit has been published in a GitHub issue, and the maintainer has not responded to the responsible disclosure.
RemediationAI
No vendor-released patch is identified at time of analysis; the maintainer has not responded to the responsible disclosure submitted via GitHub issue (https://github.com/Rizwan17/inventory-management-system/issues/15). Organizations running this software should immediately restrict network access to the application using firewall rules or authentication middleware (e.g., HTTP Basic Auth at the web server level via nginx/Apache directives), preventing direct public exposure of dashboard.php. As a more targeted compensating control, validate and enforce server-side session ownership of the userid parameter by comparing it against the authenticated session's user identity before returning any data - this requires modifying dashboard.php directly. Alternatively, remove or take offline any public-facing instance until an upstream fix is available, as the public exploit lowers the bar for exploitation. Because this is an open-source project with an unresponsive maintainer, forking and patching the repository is the most durable fix path for active operators.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is a PHP web application (cpe:2.3:a:rizwan17:inventory-management-system:*:*:*:*:*:*:*:*) hosted on GitHub under the Rizwan17 namespace. The vulnerability exists in dashboard.php, a likely authentication-gated entry point, where the userid HTTP parameter is accepted without adequate server-side authorization validation. CWE-284 (Improper Access Control) describes failures where a system does not restrict access to a resource in a manner consistent with the security policy - in this context, the server processes attacker-controlled userid values and returns data scoped to that user without verifying the requestor's entitlement. This is consistent with an Insecure Direct Object Reference (IDOR) pattern or a full authentication bypass depending on whether the page enforces session presence before accepting the parameter.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint, no privileges required per PR:N tag and Authentication Bypass tag; only low confidentiality impact, no integrity or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access controls. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB