CVE-2026-87924

Deferred Deferred - Pending Action

Authentication Bypass in Rizwan17 Inventory Management System

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: VulDB

Description

A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affects an unknown part of the file includes/invoice_bill.php of the component Invoice Generation. Such manipulation of the argument order_date/invoice_no leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-87924

EUVD

EUVD-2026-75213

Affected Vendors & Products

Vendor	Product	Version / Range
rizwan17	inventory_management_system	to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Rizwan17 inventory-management-system up to a specific commit. It involves the file includes/invoice_bill.php where manipulation of the order_date or invoice_no arguments can bypass authentication requirements. The flaw allows remote attackers to potentially access or manipulate invoice data without proper authorization.

Detection Guidance

This vulnerability involves missing authentication due to manipulation of arguments order_date or invoice_no in the invoice_bill.php component. To detect it, inspect network traffic for requests to includes/invoice_bill.php with these arguments. Check server logs for unusual invoice generation requests without proper authentication headers. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow unauthorized individuals to generate or modify invoices remotely. This may lead to financial discrepancies, data tampering, or unauthorized access to sensitive business or customer information stored in the system.

Compliance Impact

The vulnerability allows remote attackers to manipulate invoice data due to missing authentication in the invoice generation component. This could lead to unauthorized data access or modification, potentially violating GDPR (data integrity and confidentiality) and HIPAA (protected health information security).

Mitigation Strategies

Immediately restrict access to the file includes/invoice_bill.php in the Rizwan17 inventory-management-system. Review and validate all invoice generation requests for proper authentication. Monitor network traffic for unusual activity targeting this component.

Hi! I’m here to help you understand CVE-2026-87924. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70