Inventory Management System
Monthly
Authorization bypass via Insecure Direct Object Reference (IDOR) in SourceCodester Inventory Management System 1.0 allows authenticated remote attackers to access arbitrary invoice records by manipulating the ID parameter in invoice.php. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), meaning the application trusts a user-supplied identifier to gate access without server-side ownership verification. A publicly available proof-of-concept exploit exists on GitHub; no public KEV or active exploitation has been confirmed at the time of analysis.
Stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows an authenticated remote attacker to inject malicious scripts via the Product_Name parameter handled by /api/products_handler.php in the Product Management Module. When other authenticated users subsequently view affected product listings, the injected payload executes in their browsers, enabling session hijacking, credential theft, or UI redressing. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation by non-expert attackers.
Cross-site scripting in SourceCodester Inventory Management System 1.0 allows authenticated remote attackers to inject and execute arbitrary client-side scripts via the `/api/vendors_handler.php` Vendor Management endpoint. A public proof-of-concept exploit has been published on GitHub (gist by fhewm98), confirming the issue is reproducible. Exploitation requires low-privilege authentication and victim interaction, limiting blast radius, but successful attacks can hijack sessions, redirect users, or perform unauthorized actions on behalf of the victim.
Reflected or stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows an authenticated remote attacker to inject malicious JavaScript via the Customer_Name parameter in the Customer Management Module's /api/customers_handler.php endpoint. When a second user (such as an administrator) loads the affected customer record, the payload executes in their browser, enabling session hijacking or unauthorized actions on their behalf. A public proof-of-concept exploit is available on GitHub; no active exploitation (KEV) has been confirmed.
Cross-site request forgery in Rizwan17's PHP inventory-management-system allows remote attackers to perform unauthorized state-changing actions by tricking an authenticated victim into visiting a malicious page. The vulnerability exists in includes/process.php and results in limited integrity impact - an attacker can manipulate inventory data on behalf of a logged-in user without the user's knowledge. A publicly available proof-of-concept exploit (poc_idor_updateuser.py) exists; however, no KEV listing indicates no confirmed active exploitation at time of analysis.
Privilege escalation through parameter manipulation in Rizwan17's inventory-management-system allows remote unauthenticated attackers to register accounts with arbitrary privilege levels, including administrative roles, by supplying a crafted `usertype` value to the `createUserAccount` function in `register.php`. The vulnerability stems from the registration handler trusting client-controlled role values without server-side enforcement of permitted self-registration tiers. A public exploit is available via a GitHub issue report, and the vendor has not responded to the coordinated disclosure as of the time of reporting.
Improper access control in Rizwan17's PHP-based inventory-management-system exposes dashboard.php to unauthorized access via manipulation of the `userid` parameter, allowing remote unauthenticated attackers to access other users' data or bypass authentication controls. The affected codebase is identified by commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f and is distributed as a rolling release with no versioned patch available. A public proof-of-concept exploit has been published in a GitHub issue, and the maintainer has not responded to the responsible disclosure.
SQL injection in Rizwan17's inventory-management-system allows unauthenticated remote attackers to manipulate database queries via the `pro_name[]` array parameter in the `storeCustomerOrderInvoice` function of `includes/manage.php`. The CVSS 4.0 vector (PR:N/AC:L/AT:N) confirms no authentication is required and exploitation is straightforward. A public proof-of-concept exists via GitHub issue #13, and the vendor has not responded to the disclosure, leaving no patch available.
Missing authentication on the Invoice Generation endpoint in Rizwan17's inventory-management-system (PHP, all commits through bfe78a33) allows unauthenticated remote attackers to manipulate the `order_date` and `invoice_no` parameters in `includes/invoice_bill.php` without any credential check (CWE-306). The CVSS 4.0 vector confirms PR:N/UI:N exploitation with low integrity and availability impact and no confidentiality exposure. A public proof-of-concept has been disclosed via GitHub issue #14, and the project maintainer has not yet responded to the report, leaving no patch available at time of analysis.
Cross-site scripting in Rizwan17's open-source PHP inventory-management-system allows remote attackers to inject arbitrary JavaScript via unsanitized category_name, brand_name, or product_name parameters handled by the List Handler in includes/DBOperation.php. A publicly available proof-of-concept (GitHub issue #12) demonstrates exploitation. No patch exists - the maintainer has not responded to the responsible disclosure report - and the project uses rolling releases with no versioned fix available.
Unauthenticated SQL injection in rabindralamsal's inventory-management-system 1.0.0 exposes the login endpoint (index.php) to direct database manipulation via unsanitized username and password parameters. An attacker with network access can craft malicious SQL payloads to bypass authentication, enumerate database contents, or alter stored records without any prior credential or privilege. A public proof-of-concept exploit exists (GitHub issue), making this immediately actionable by low-skill attackers; no patch has been identified.
Stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows a low-privileged remote attacker to inject arbitrary JavaScript via the `full_name` parameter of the User Registration Endpoint at `/api/users_handler.php`. When a privileged user such as an administrator subsequently views the stored user data, the malicious script executes in their browser context, enabling session hijacking, credential theft, or UI redress. Public exploit code exists per VulDB (E:P in CVSS 4.0 vector); however, this vulnerability is not listed in CISA KEV and carries a low CVSS 4.0 base score of 2.0, indicating limited real-world severity.
Privilege escalation via role parameter manipulation in SourceCodester Inventory Management System 1.0 allows unauthenticated remote attackers to self-assign elevated roles during user registration. The vulnerability resides in /api/users_handler.php, where the application fails to enforce server-side restrictions on the role argument at the User Registration Endpoint, enabling account creation with admin-level privileges. A public proof-of-concept exploit is available, lowering the skill bar for abuse against any exposed instance; no CISA KEV listing exists, so confirmed active exploitation in the wild has not been established.
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter in the Login component, leading to unauthorized database access and potential data exfiltration. The vulnerability has a publicly available exploit and CVSS 6.9 score reflecting low confidentiality, integrity, and availability impact without scope expansion. EPSS data unavailable, but public exploit availability elevates practical risk.
A remote code execution vulnerability in A security vulnerability (CVSS 4.7). Risk factors: public PoC available.
A weakness has been identified in SourceCodester Inventory Management System 1.0. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to manipulate database queries via the edituserName parameter in /php_action/editUser.php. The exploit is publicly available, but the EPSS score is only 0.05%, indicating low probability of widespread exploitation. No evidence of active exploitation has been reported.
SQL injection in code-projects Inventory Management System 1.0 allows remote, unauthenticated attackers to manipulate the userid parameter in /php_action/removeUser.php, potentially executing arbitrary SQL commands. Publicly available exploit code exists, but the EPSS exploitation probability is low (0.05%). No evidence of active exploitation has been reported.
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter in /php_action/createUser.php, leading to unauthorized data access or modification. Public exploit code is available (GitHub issue), but the EPSS exploitation probability is low (0.05%). The vulnerability is classified as critical despite a moderate CVSS base score, and no vendor-released patch has been identified.
SQL injection in Inventory Management System 1.0 allows unauthorized database manipulation via the orderId parameter. An unauthenticated remote attacker can exploit the /php_action/editPayment.php endpoint to execute arbitrary SQL statements. Public exploit code is available, though no active exploitation has been confirmed, and the EPSS probability is low.
We need to generate a JSON object with the specified fields. Let's extract information from the provided data. - CVE ID: CVE-2025-6828 - Description: "A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /orders.php. The manipulation of the argument i leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used." - CVSS Score: 5.5 (but vector is CVSS 4.0, given) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... (base part: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) - CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')) - EPSS: 0.06% (18th percentile) - POC/Exploit: Publicly available - KEV: not mentioned (so not in KEV) - Tags: PHP, SQLi - CPE: cpe:2.3:a:code-projects:inventory_management_system:1.0:*:*:*:*:*:*:* - Affected versions: "Inventory Management System 1.0" - References: many, including vuldb entries and github exploit. We need to produce a comprehensive analysis. Fields to fill: product_name: "Inventory Management System" (code-projects Inventory Management System, but 1-3 words only: "Inventory Management System" might be too generic? Could be "Code-Projects Inventory Management System", but that's 4 words. The instruction: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description. If multiple products, pick the primary one." Here vendor is "code-projects", product is "Inventory Management System". That's 3 words if you count "Code-Projects" as one? Usually hyphenated. I'll go with "Inventory Management System" (3 words) or "Code-Projects Inventory Management System" (4 words). Need 1-3 words, so "Inventory Management S
SQL injection in code-projects Inventory Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the editOrder.php file. Public exploit code exists, though EPSS indicates low exploitation probability (0.06%) and no active exploitation has been confirmed.
SQL injection in Inventory Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the editProductName parameter in /php_action/editProduct.php. A public proof-of-concept exploit exists, but no active exploitation has been confirmed. The vulnerability has a medium CVSS 4.0 score and low EPSS likelihood, indicating limited practical risk outside of exposed installations.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the productId parameter in /php_action/removeProduct.php. An unauthenticated attacker can potentially access or modify database contents, though impact is rated low. A public proof-of-concept exists, but EPSS indicates low exploitation probability.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to manipulate database queries via the /php_action/createOrder.php endpoint. Exploit code is publicly available, but no active exploitation has been confirmed. The issue affects a niche open-source project with limited real-world deployment, resulting in low overall risk despite easy exploitability.
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to interfere with database queries via the productName parameter in /php_action/createProduct.php. Exploit code is publicly available, though the EPSS score of 0.06% indicates a low probability of widespread exploitation at this time.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to manipulate the brandId parameter in removeBrand.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available but no active exploitation has been confirmed, and EPSS risk is low.
CVE-2025-6668 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/fetchSelectedBrand.php endpoint via the brandId parameter. An unauthenticated remote attacker can exploit this vulnerability to read, modify, or delete database contents, with disclosed public exploits and active exploitation potential. The CVSS 7.3 score reflects moderate impact across confidentiality, integrity, and availability, though the attack requires no privileges or user interaction.
CVE-2025-6665 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/editBrand.php file's editBrandStatus parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with a proof-of-concept available, increasing real-world exploitation risk.
CVE-2025-6612 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/removeCategories.php endpoint. An unauthenticated remote attacker can manipulate the 'categoriesId' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available and demonstrates active exploitation potential with a CVSS 7.3 score indicating moderate-to-high severity.
CVE-2025-6611 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/createBrand.php endpoint via the brandStatus parameter. The vulnerability allows unauthenticated remote attackers to manipulate SQL queries, potentially resulting in unauthorized data access, modification, or deletion. Public exploit disclosure and active exploitation risk are confirmed.
CVE-2025-6503 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/fetchSelectedCategories.php file where the 'categoriesId' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The exploit has been publicly disclosed and proof-of-concept code is available, significantly elevating exploitation risk in production environments.
CVE-2025-6502 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/changePassword.php file where the user_id parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit details available, increasing immediate risk of active exploitation.
CVE-2025-6501 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/createCategories.php file, where the 'categoriesStatus' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. Public exploit disclosure and proof-of-concept availability indicate active threat potential with low barrier to exploitation.
CVE-2025-6500 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/editCategories.php file where the 'editCategoriesName' parameter is inadequately sanitized. An unauthenticated attacker can exploit this remotely to read, modify, or delete database contents, affecting confidentiality, integrity, and availability. Public exploit disclosure and confirmed proof-of-concept availability increase real-world risk significantly.
CVE-2025-6474 is a critical SQL injection vulnerability in code-projects Inventory Management System version 1.0 affecting the /changeUsername.php file, specifically the user_id parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with proof-of-concept availability, making active exploitation likely.
Sourcecodester Free and Open Source inventory management system 1.0 is vulnerable to Cross Site Scripting (XSS) via the Add supplier function. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in SourceCodester Inventory Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in SourceCodester Inventory Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as problematic. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, has been found in SourceCodester Inventory Management System 1.0.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Inventory Management System 1.0 and classified as critical.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Inventory Management System 1.0 and classified as critical.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as problematic. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A stored cross-site scripting (XSS) vulnerability in the component php-inventory-management-system/brand.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management System v1 allows attackers to execute arbitrary web. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/product.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/categories.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authorization bypass via Insecure Direct Object Reference (IDOR) in SourceCodester Inventory Management System 1.0 allows authenticated remote attackers to access arbitrary invoice records by manipulating the ID parameter in invoice.php. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), meaning the application trusts a user-supplied identifier to gate access without server-side ownership verification. A publicly available proof-of-concept exploit exists on GitHub; no public KEV or active exploitation has been confirmed at the time of analysis.
Stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows an authenticated remote attacker to inject malicious scripts via the Product_Name parameter handled by /api/products_handler.php in the Product Management Module. When other authenticated users subsequently view affected product listings, the injected payload executes in their browsers, enabling session hijacking, credential theft, or UI redressing. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation by non-expert attackers.
Cross-site scripting in SourceCodester Inventory Management System 1.0 allows authenticated remote attackers to inject and execute arbitrary client-side scripts via the `/api/vendors_handler.php` Vendor Management endpoint. A public proof-of-concept exploit has been published on GitHub (gist by fhewm98), confirming the issue is reproducible. Exploitation requires low-privilege authentication and victim interaction, limiting blast radius, but successful attacks can hijack sessions, redirect users, or perform unauthorized actions on behalf of the victim.
Reflected or stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows an authenticated remote attacker to inject malicious JavaScript via the Customer_Name parameter in the Customer Management Module's /api/customers_handler.php endpoint. When a second user (such as an administrator) loads the affected customer record, the payload executes in their browser, enabling session hijacking or unauthorized actions on their behalf. A public proof-of-concept exploit is available on GitHub; no active exploitation (KEV) has been confirmed.
Cross-site request forgery in Rizwan17's PHP inventory-management-system allows remote attackers to perform unauthorized state-changing actions by tricking an authenticated victim into visiting a malicious page. The vulnerability exists in includes/process.php and results in limited integrity impact - an attacker can manipulate inventory data on behalf of a logged-in user without the user's knowledge. A publicly available proof-of-concept exploit (poc_idor_updateuser.py) exists; however, no KEV listing indicates no confirmed active exploitation at time of analysis.
Privilege escalation through parameter manipulation in Rizwan17's inventory-management-system allows remote unauthenticated attackers to register accounts with arbitrary privilege levels, including administrative roles, by supplying a crafted `usertype` value to the `createUserAccount` function in `register.php`. The vulnerability stems from the registration handler trusting client-controlled role values without server-side enforcement of permitted self-registration tiers. A public exploit is available via a GitHub issue report, and the vendor has not responded to the coordinated disclosure as of the time of reporting.
Improper access control in Rizwan17's PHP-based inventory-management-system exposes dashboard.php to unauthorized access via manipulation of the `userid` parameter, allowing remote unauthenticated attackers to access other users' data or bypass authentication controls. The affected codebase is identified by commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f and is distributed as a rolling release with no versioned patch available. A public proof-of-concept exploit has been published in a GitHub issue, and the maintainer has not responded to the responsible disclosure.
SQL injection in Rizwan17's inventory-management-system allows unauthenticated remote attackers to manipulate database queries via the `pro_name[]` array parameter in the `storeCustomerOrderInvoice` function of `includes/manage.php`. The CVSS 4.0 vector (PR:N/AC:L/AT:N) confirms no authentication is required and exploitation is straightforward. A public proof-of-concept exists via GitHub issue #13, and the vendor has not responded to the disclosure, leaving no patch available.
Missing authentication on the Invoice Generation endpoint in Rizwan17's inventory-management-system (PHP, all commits through bfe78a33) allows unauthenticated remote attackers to manipulate the `order_date` and `invoice_no` parameters in `includes/invoice_bill.php` without any credential check (CWE-306). The CVSS 4.0 vector confirms PR:N/UI:N exploitation with low integrity and availability impact and no confidentiality exposure. A public proof-of-concept has been disclosed via GitHub issue #14, and the project maintainer has not yet responded to the report, leaving no patch available at time of analysis.
Cross-site scripting in Rizwan17's open-source PHP inventory-management-system allows remote attackers to inject arbitrary JavaScript via unsanitized category_name, brand_name, or product_name parameters handled by the List Handler in includes/DBOperation.php. A publicly available proof-of-concept (GitHub issue #12) demonstrates exploitation. No patch exists - the maintainer has not responded to the responsible disclosure report - and the project uses rolling releases with no versioned fix available.
Unauthenticated SQL injection in rabindralamsal's inventory-management-system 1.0.0 exposes the login endpoint (index.php) to direct database manipulation via unsanitized username and password parameters. An attacker with network access can craft malicious SQL payloads to bypass authentication, enumerate database contents, or alter stored records without any prior credential or privilege. A public proof-of-concept exploit exists (GitHub issue), making this immediately actionable by low-skill attackers; no patch has been identified.
Stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows a low-privileged remote attacker to inject arbitrary JavaScript via the `full_name` parameter of the User Registration Endpoint at `/api/users_handler.php`. When a privileged user such as an administrator subsequently views the stored user data, the malicious script executes in their browser context, enabling session hijacking, credential theft, or UI redress. Public exploit code exists per VulDB (E:P in CVSS 4.0 vector); however, this vulnerability is not listed in CISA KEV and carries a low CVSS 4.0 base score of 2.0, indicating limited real-world severity.
Privilege escalation via role parameter manipulation in SourceCodester Inventory Management System 1.0 allows unauthenticated remote attackers to self-assign elevated roles during user registration. The vulnerability resides in /api/users_handler.php, where the application fails to enforce server-side restrictions on the role argument at the User Registration Endpoint, enabling account creation with admin-level privileges. A public proof-of-concept exploit is available, lowering the skill bar for abuse against any exposed instance; no CISA KEV listing exists, so confirmed active exploitation in the wild has not been established.
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter in the Login component, leading to unauthorized database access and potential data exfiltration. The vulnerability has a publicly available exploit and CVSS 6.9 score reflecting low confidentiality, integrity, and availability impact without scope expansion. EPSS data unavailable, but public exploit availability elevates practical risk.
A remote code execution vulnerability in A security vulnerability (CVSS 4.7). Risk factors: public PoC available.
A weakness has been identified in SourceCodester Inventory Management System 1.0. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to manipulate database queries via the edituserName parameter in /php_action/editUser.php. The exploit is publicly available, but the EPSS score is only 0.05%, indicating low probability of widespread exploitation. No evidence of active exploitation has been reported.
SQL injection in code-projects Inventory Management System 1.0 allows remote, unauthenticated attackers to manipulate the userid parameter in /php_action/removeUser.php, potentially executing arbitrary SQL commands. Publicly available exploit code exists, but the EPSS exploitation probability is low (0.05%). No evidence of active exploitation has been reported.
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter in /php_action/createUser.php, leading to unauthorized data access or modification. Public exploit code is available (GitHub issue), but the EPSS exploitation probability is low (0.05%). The vulnerability is classified as critical despite a moderate CVSS base score, and no vendor-released patch has been identified.
SQL injection in Inventory Management System 1.0 allows unauthorized database manipulation via the orderId parameter. An unauthenticated remote attacker can exploit the /php_action/editPayment.php endpoint to execute arbitrary SQL statements. Public exploit code is available, though no active exploitation has been confirmed, and the EPSS probability is low.
We need to generate a JSON object with the specified fields. Let's extract information from the provided data. - CVE ID: CVE-2025-6828 - Description: "A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /orders.php. The manipulation of the argument i leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used." - CVSS Score: 5.5 (but vector is CVSS 4.0, given) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... (base part: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) - CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')) - EPSS: 0.06% (18th percentile) - POC/Exploit: Publicly available - KEV: not mentioned (so not in KEV) - Tags: PHP, SQLi - CPE: cpe:2.3:a:code-projects:inventory_management_system:1.0:*:*:*:*:*:*:* - Affected versions: "Inventory Management System 1.0" - References: many, including vuldb entries and github exploit. We need to produce a comprehensive analysis. Fields to fill: product_name: "Inventory Management System" (code-projects Inventory Management System, but 1-3 words only: "Inventory Management System" might be too generic? Could be "Code-Projects Inventory Management System", but that's 4 words. The instruction: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description. If multiple products, pick the primary one." Here vendor is "code-projects", product is "Inventory Management System". That's 3 words if you count "Code-Projects" as one? Usually hyphenated. I'll go with "Inventory Management System" (3 words) or "Code-Projects Inventory Management System" (4 words). Need 1-3 words, so "Inventory Management S
SQL injection in code-projects Inventory Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the editOrder.php file. Public exploit code exists, though EPSS indicates low exploitation probability (0.06%) and no active exploitation has been confirmed.
SQL injection in Inventory Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the editProductName parameter in /php_action/editProduct.php. A public proof-of-concept exploit exists, but no active exploitation has been confirmed. The vulnerability has a medium CVSS 4.0 score and low EPSS likelihood, indicating limited practical risk outside of exposed installations.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the productId parameter in /php_action/removeProduct.php. An unauthenticated attacker can potentially access or modify database contents, though impact is rated low. A public proof-of-concept exists, but EPSS indicates low exploitation probability.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to manipulate database queries via the /php_action/createOrder.php endpoint. Exploit code is publicly available, but no active exploitation has been confirmed. The issue affects a niche open-source project with limited real-world deployment, resulting in low overall risk despite easy exploitability.
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to interfere with database queries via the productName parameter in /php_action/createProduct.php. Exploit code is publicly available, though the EPSS score of 0.06% indicates a low probability of widespread exploitation at this time.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to manipulate the brandId parameter in removeBrand.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available but no active exploitation has been confirmed, and EPSS risk is low.
CVE-2025-6668 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/fetchSelectedBrand.php endpoint via the brandId parameter. An unauthenticated remote attacker can exploit this vulnerability to read, modify, or delete database contents, with disclosed public exploits and active exploitation potential. The CVSS 7.3 score reflects moderate impact across confidentiality, integrity, and availability, though the attack requires no privileges or user interaction.
CVE-2025-6665 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/editBrand.php file's editBrandStatus parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with a proof-of-concept available, increasing real-world exploitation risk.
CVE-2025-6612 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/removeCategories.php endpoint. An unauthenticated remote attacker can manipulate the 'categoriesId' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available and demonstrates active exploitation potential with a CVSS 7.3 score indicating moderate-to-high severity.
CVE-2025-6611 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/createBrand.php endpoint via the brandStatus parameter. The vulnerability allows unauthenticated remote attackers to manipulate SQL queries, potentially resulting in unauthorized data access, modification, or deletion. Public exploit disclosure and active exploitation risk are confirmed.
CVE-2025-6503 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/fetchSelectedCategories.php file where the 'categoriesId' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The exploit has been publicly disclosed and proof-of-concept code is available, significantly elevating exploitation risk in production environments.
CVE-2025-6502 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/changePassword.php file where the user_id parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit details available, increasing immediate risk of active exploitation.
CVE-2025-6501 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/createCategories.php file, where the 'categoriesStatus' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. Public exploit disclosure and proof-of-concept availability indicate active threat potential with low barrier to exploitation.
CVE-2025-6500 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/editCategories.php file where the 'editCategoriesName' parameter is inadequately sanitized. An unauthenticated attacker can exploit this remotely to read, modify, or delete database contents, affecting confidentiality, integrity, and availability. Public exploit disclosure and confirmed proof-of-concept availability increase real-world risk significantly.
CVE-2025-6474 is a critical SQL injection vulnerability in code-projects Inventory Management System version 1.0 affecting the /changeUsername.php file, specifically the user_id parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with proof-of-concept availability, making active exploitation likely.
Sourcecodester Free and Open Source inventory management system 1.0 is vulnerable to Cross Site Scripting (XSS) via the Add supplier function. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in SourceCodester Inventory Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in SourceCodester Inventory Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as problematic. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, has been found in SourceCodester Inventory Management System 1.0.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Inventory Management System 1.0 and classified as critical.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Inventory Management System 1.0 and classified as critical.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as problematic. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A stored cross-site scripting (XSS) vulnerability in the component php-inventory-management-system/brand.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management System v1 allows attackers to execute arbitrary web. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/product.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/categories.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.