Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

Mini Inventory System can run malicious database commands

CVE-2026-100887 · published 21 days ago
Summary

The Mini Inventory and Sales Management System's database query builder lets an attacker change the orderBy setting to inject harmful database commands, which can be done from anywhere on the internet. This could let a bad actor view, change, or delete your inventory data. Stop using the software, or replace it with a maintained alternative that validates input before building queries.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
amirsanni mini-inventory-and-sales-management-system 81bf0b55f5933f3b0dbb1583204a612e06605b95
Original advisory text
amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection
A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function order_by of the file DB_query_builder.php of the component Database Query Builder. Performing a manipulation of the argument orderBy results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project maintainer confirms: "I stopped maintaining that project for a while now, so I'm not sure it's worth fixing." This vulnerability only affects products that are no longer supported by the maintainer.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
CWE-74Injection
Timeline
Published28 Sep 2026
Updated19 Oct 2026
First seen28 Sep 2026
Sources
CVE-2026-100887 · NVD
CVE-2026-100887 · MITRE
Track software like this
Free during beta