CVE-2026-100904
Received Received - Intake

Cross-Site Scripting in Mini-Inventory-and-Sales-Management-System

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description
A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is an unknown function of the file application/controllers/Items.php of the component Items Management Module. The manipulation of the argument itemName leads to cross site scripting. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-100904
EUVD
EUVD-2026-88071

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
amirsanni mini-inventory-and-sales-management-system to 81bf0b55f5933f3b0dbb1583204a612e06605b95 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in the Items Management Module of the amirsanni mini-inventory-and-sales-management-system. It allows attackers to inject malicious scripts via the itemName parameter in the Items.php file. The system uses a rolling release model, so specific affected versions are not listed.

Detection Guidance

This vulnerability involves a cross-site scripting (XSS) flaw in the Items Management Module of amirsanni mini-inventory-and-sales-management-system. To detect it, inspect the application/controllers/Items.php file for improper input handling in the itemName argument. Look for unsanitized user input being reflected in web output. Check for JavaScript execution in browser developer tools when manipulating itemName parameters.

Impact Analysis

An attacker could exploit this to execute malicious scripts in a user's browser, potentially stealing session cookies, redirecting users to phishing sites, or performing actions on their behalf. This requires user interaction, such as clicking a crafted link.

Compliance Impact

The vulnerability allows cross-site scripting (XSS) via manipulation of the itemName argument in the Items Management Module. This could enable attackers to inject malicious scripts into web pages, potentially leading to unauthorized data access or manipulation. Such risks may impact compliance with GDPR (data protection) and HIPAA (healthcare data privacy) by exposing sensitive user or patient information.

Mitigation Strategies

Immediately update to the latest version of amirsanni mini-inventory-and-sales-management-system if available. If no patch exists, implement input validation and output encoding for the itemName parameter in Items.php. Sanitize all user inputs and escape dynamic content before rendering. Consider disabling the Items Management Module if not critical until a fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100904. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart