Inventariobasico
Monthly
Stored/reflected cross-site scripting in the Add Product page of configuroweb inventariobasico allows a low-privileged authenticated user to inject script into the 'product name' argument handled by addlist.php. Exploitation requires both a valid account able to reach that page (PR:L) and a victim who views the page where the payload renders (UI:P), which materially limits real-world exposure; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, consistent with a medium-severity score of 5.1 under the CVSS 4.0 vector supplied. No public working exploit has been confirmed - a public PoC reference exists (a GitHub issue on the project repository); it is not verified as working exploit code. There is no CISA KEV listing, and the project operates on a rolling release with no fixed build available and no vendor response to the reported issue.
Stored/reflected cross-site scripting in the Add Product page of configuroweb inventariobasico allows a low-privileged authenticated user to inject script into the 'product name' argument handled by addlist.php. Exploitation requires both a valid account able to reach that page (PR:L) and a victim who views the page where the payload renders (UI:P), which materially limits real-world exposure; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, consistent with a medium-severity score of 5.1 under the CVSS 4.0 vector supplied. No public working exploit has been confirmed - a public PoC reference exists (a GitHub issue on the project repository); it is not verified as working exploit code. There is no CISA KEV listing, and the project operates on a rolling release with no fixed build available and no vendor response to the reported issue.