CVE-2026-71252

Name of the Vulnerable Software and Affected Versions toner-management (affected versions not specified)

Description Admin state-changing handlers executed database operations including INSERT, UPDATE, and DELETE without authentication or authorization checks, although access control was present in listing views. This allows an unauthenticated remote attacker to directly invoke these handlers to create, modify, or destroy application data. The affected endpoints include 'add.php', 'edit.php', and 'delete.php' located under 'admin/toners', 'admin/toner-brands', 'admin/printers', and related admin subdirectories.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.