CVE-2026-71248

Name of the Vulnerable Software and Affected Versions Inventory-Management-System-PHP (affected versions not specified)

Description The software contains SQL injection flaws in two separate components. The 'login.php' endpoint constructs authentication queries using direct string concatenation of raw POST parameters email and password, which allows an attacker to bypass authentication. Additionally, the 'delete.php' endpoint executes queries using the id GET parameter without authentication checks or input validation, enabling unauthenticated attackers to delete arbitrary product records or perform blind SQL injection. Blind SQL injection is a technique used to extract information from a database by observing the time it takes for the server to respond to specific queries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.