CVE-2026-87926

Deferred Deferred - Pending Action

Cross-Site Scripting in Rizwan17 Inventory Management System

Publication date: 2026-09-10

Last updated on: 2026-09-14

Assigner: VulDB

Description

A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the file index.php of the component Login Page. Executing a manipulation of the argument msg can lead to cross site scripting. The attack can be launched remotely. The exploit has been published and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-14

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-87926

EUVD

EUVD-2026-75220

Affected Vendors & Products

Vendor	Product	Version / Range
rizwan17	inventory-management-system	to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This is a reflected Cross-Site Scripting (XSS) vulnerability in the inventory-management-system. The issue occurs in the index.php file of the Login Page component. The msg GET parameter is printed into a Bootstrap alert without proper sanitization, allowing attackers to inject malicious scripts. The root cause is the lack of output encoding, as client-side JavaScript does not HTML-encode the output.

Detection Guidance

To detect this reflected XSS vulnerability, inspect network traffic for GET requests to index.php containing the msg parameter with unsanitized input. Manually test by appending a script payload like <script>alert(1)</script> to the msg parameter in URLs and observe if it executes in the browser.

Impact Analysis

An attacker can craft a malicious link with a script payload in the msg parameter. When opened in a browser, this executes the injected script. Potential impacts include session cookie theft (if not HttpOnly), UI forgery, credential phishing, or unauthorized actions. No authentication is required to exploit this vulnerability.

Compliance Impact

This vulnerability, a reflected XSS flaw in the inventory-management-system, could impact compliance with GDPR and HIPAA by enabling session cookie theft, UI forgery, or credential phishing. If session cookies are stolen, unauthorized access to personal or health data may occur, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information.

Mitigation Strategies

Immediately sanitize the msg parameter output in index.php using server-side HTML encoding before rendering. Replace direct variable output with context-aware escaping functions. Disable or restrict access to the login page until patched. Monitor for unusual activity or unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-87926. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70