Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-71207: Stock-Inventory-Management-System's login.php bypasses authentication
CVE-2026-71207
Summary
An attacker can log in without a password by submitting a special input to the login form. This is because the system doesn't properly check user input. Additionally, the system has hardcoded admin credentials that can be used to access the system without a password. This is a serious issue because it allows unauthorized access to the system. To fix this, the system should be updated to properly validate user input and remove hardcoded admin credentials.
Original title
The Stock-Inventory-Management-System application's login.php assigns raw $_POST username/password values to $_SESSION and builds its authentication query by directly concatenating those session va...
Original description
The Stock-Inventory-Management-System application's login.php assigns raw $_POST username/password values to $_SESSION and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. An unauthenticated remote attacker can submit a payload such as ' OR '1'='1 in the login form to bypass authentication entirely. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path.
nvd CVSS3.1
9.8
Vulnerability type
CWE-89
SQL Injection
Published: 5 Aug 2026 · Updated: 5 Aug 2026 · First seen: 5 Aug 2026