CVE-2026-71207

Name of the Vulnerable Software and Affected Versions Stock-Inventory-Management-System (affected versions not specified)

Description The login.php endpoint is susceptible to authentication bypass. The application assigns raw $ POST values from the username and password variables to the $ SESSION and concatenates these values directly into a SQL statement without parameterization or escaping. This allows an unauthenticated remote attacker to bypass authentication using SQL injection payloads. Additionally, the script contains hardcoded administrative credentials (admin/neola) within a post-login conditional check, creating another path for full authentication bypass.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.