CVE-2026-87923

Deferred Deferred - Pending Action

Cross-Site Scripting in Rizwan17 Inventory Management System

Publication date: 2026-09-09

Last updated on: 2026-09-11

Assigner: VulDB

Description

A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is some unknown functionality of the file includes/DBOperation.php of the component List Handler. This manipulation of the argument category_name/brand_name/product_name causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-11

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-87923

EUVD

EUVD-2026-75211

Affected Vendors & Products

Vendor	Product	Version / Range
rizwan17	inventory-management-system	to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) weakness in the Rizwan17 inventory-management-system. It exists in the List Handler component, specifically in the includes/DBOperation.php file. The issue arises from improper handling of user input in the category_name, brand_name, or product_name arguments, allowing attackers to inject malicious scripts.

Detection Guidance

This vulnerability involves a reflected cross-site scripting (XSS) flaw in the inventory-management-system's List Handler component. To detect it, inspect HTTP requests to includes/DBOperation.php for unsanitized user input in category_name, brand_name, or product_name parameters. Look for reflected XSS payloads in responses. Use tools like Burp Suite or OWASP ZAP to fuzz these parameters with XSS test strings such as <script>alert(1)</script>.

Impact Analysis

An attacker could exploit this to execute arbitrary scripts in a victim's browser, potentially stealing session cookies, redirecting to malicious sites, or performing actions on behalf of the user. Since the exploit is public, the risk of real-world attacks is higher.

Compliance Impact

This vulnerability involves a cross-site scripting (XSS) flaw in the inventory-management-system, allowing remote attackers to inject malicious scripts via manipulated arguments. While not directly tied to GDPR or HIPAA, XSS vulnerabilities can lead to data breaches, unauthorized access, or data theft, which may violate compliance requirements for protecting sensitive personal or health information under these regulations.

Mitigation Strategies

Immediately restrict access to the vulnerable file includes/DBOperation.php in Rizwan17 inventory-management-system. Disable or remove the List Handler component if not essential. Monitor network traffic for unusual XSS-related activity targeting category_name, brand_name, or product_name parameters.

Hi! I’m here to help you understand CVE-2026-87923. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70