inventory-management-system CVE-2026-90566

Exploitation requires that the application's user registration endpoint (register.php) is publicly accessible over the network and that self-registration is enabled (the default configuration). No authentication, no special network position, and no user interaction are required - the attack works against any internet-exposed instance in its default state. The only limiting factor is deployment footprint: this is an obscure, single-developer PHP project, so instances are rare. There are no platform-specific prerequisites beyond a functioning PHP web server running this application.

The CVSS 4.0 base score of 5.5 (Medium) with E:P (proof-of-concept) reflects a low-complexity, network-reachable, unauthenticated attack requiring no user interaction, but with limited direct impact per metric (VC:L/VI:L/VA:L). In practice, the real-world risk may be understated by this score: an attacker who can self-register as an administrator gains full control of the inventory application's data and management functions, making the integrity impact functionally higher than 'Low' in operational terms. The public exploit lowers the skill bar for abuse, meaning even a mid-sized municipal IT team in inowroclaw managing internal stock with this application should treat remediation as urgent rather than routine. There is no CISA KEV listing, so confirmed active exploitation in the wild is unverified. EPSS data is not provided in the input, so statistical exploitation probability is unknown. The primary limiting factors are that the affected product is an obscure, community-developed PHP application with a small deployment footprint, reducing the likelihood of opportunistic mass exploitation.

An attacker discovers a publicly exposed instance of the inventory-management-system by searching for its characteristic URLs or registration page. They submit a registration POST request to register.php with the usertype parameter set to an administrator role value (e.g., usertype=admin), creating a fully privileged admin account without any prior credentials. The attacker then logs in with the newly created account and has full access to inventory data, user management, and system configuration.