Mini Inventory System EUVD-2026-63188

Exploitation requires a valid low-privilege authenticated session on the target Mini-Inventory-and-Sales-Management-System instance (PR:L per the CVSS 4.0 source vector). The attacker must be able to send HTTP requests to the transaction listing endpoint that invokes Transaction::getAll, meaning the web application must be network-accessible and the attacker must hold at minimum a standard user-level account. No special server-side configuration beyond a default installation is required. Exploitation is limited to the vulnerable system's database (VC:L/VI:L/VA:L) - no scope change to subsequent systems is indicated. Factors limiting exploitation: an attacker without credentials cannot exploit this remotely; the project's extremely low deployment footprint means the exposed population is small; and the relatively low impact metrics (L/L/L) suggest partial rather than full database compromise.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) yields a score of 5.3 (Medium), reflecting network exploitability with low-complexity attack requirements but constrained by required low-privilege authentication and limited blast radius (partial data read/write, no subsequent-system scope change). The E:P supplemental metric confirms proof-of-concept code is publicly available, directly lowering the attacker skill threshold. No EPSS score was provided in source data - exploitation probability cannot be quantified from this dataset. KEV status is absent, meaning active widespread exploitation is not confirmed. The combination of no patch, public POC, and no vendor response increases the practical risk to any running instance, though the niche/rare deployment footprint of this hobby-grade project sharply limits the overall attack surface. This is a genuine priority for any organization actually using this software, but not a broad ecosystem threat.

An attacker with a low-privilege user account logs into the Mini-Inventory-and-Sales-Management-System web interface and submits a crafted HTTP request to the transaction listing endpoint, injecting a UNION-based or error-based SQL payload via the orderBy parameter to extract data from sensitive tables such as user credentials or financial records. A public proof-of-concept is available via GitHub issue #101, making this attack reproducible by low-skill threat actors without requiring custom exploit development.