Inventory Tracking Application
Monthly
Unauthenticated SQL injection in Starnet Computer and Network Systems' Inventory Tracking Application (all builds through 2026-10-16) lets remote attackers reach the backend database and read data they should never see, rated CVSS 3.1 7.5 with confidentiality-only impact (C:H/I:N/A:N). Per the vector AV:N/AC:L/PR:N/UI:N, no credentials and no user interaction are required, so any internet- or network-exposed deployment on a default configuration is directly reachable. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV; practical risk is dominated by deployment scarcity, since the product has a very small installed base and only exposed instances are realistically at risk (vuln.today priority: this_week).
Unauthenticated SQL injection in Starnet Computer and Network Systems' Inventory Tracking Application (all builds through 2026-10-16) lets remote attackers reach the backend database and read data they should never see, rated CVSS 3.1 7.5 with confidentiality-only impact (C:H/I:N/A:N). Per the vector AV:N/AC:L/PR:N/UI:N, no credentials and no user interaction are required, so any internet- or network-exposed deployment on a default configuration is directly reachable. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV; practical risk is dominated by deployment scarcity, since the product has a very small installed base and only exposed instances are realistically at risk (vuln.today priority: this_week).