code-projects Inventory Management System EUVD-2026-25746

The vulnerability requires no special conditions beyond network access to the Login component and default configuration of code-projects Inventory Management System 1.0. Remote unauthenticated exploitation is possible against any deployed instance of version 1.0 where the Username parameter is not filtered. The only limiting factor is that the attack is constrained to the scope of the application's database permissions - if the database user lacks write access or access to other databases, the attacker cannot modify data or access data beyond the application schema. The vulnerability is not dependent on user interaction (UI:N) or specific authentication state (PR:N), making it exploitable immediately upon network access.

CVSS 6.9 indicates moderate severity with network-accessible attack surface (AV:N), low complexity (AC:L), and no authentication barriers (PR:N). However, the impact vector shows limited scope (SC:N with partial VC:L/VI:L/VA:L) - the vulnerability does not affect system confidentiality, integrity, or availability globally, suggesting the database accessed is isolated or contains non-critical data. The public exploit availability (POC=YES) significantly increases real-world risk despite the moderate CVSS score, as attackers can immediately weaponize the vulnerability. No KEV confirmation or EPSS score provided limits assessment precision. The lack of scope change (S:N in CVSS 4.0 context) suggests the SQL injection may be constrained to read-only operations or limited to the application's own database rather than broader system compromise. This is a real but bounded threat requiring immediate patching, particularly in internet-facing deployments.

An attacker sends a crafted HTTP POST request to the Login endpoint with a malicious SQL payload in the Username field, such as admin' OR '1'='1 or admin' UNION SELECT password FROM users --, bypassing authentication and either logging in as the admin user or exfiltrating the user credential table. With the publicly available exploit code, an attacker can automate this attack to enumerate database contents, modify data, or extract sensitive information without any authentication.