Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-71248: Inventory-Management-System-PHP: Unauthenticated Product Deletion and Login Bypass
CVE-2026-71248
CVE-2026-71248
Summary
An attacker can delete products without permission and bypass login security. This is a serious issue because it allows unauthorized access to sensitive data and actions. Update the software to fix this issue and ensure all user input is properly validated and sanitized.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| harsh21patel | inventory-management-system-php | All versions |
Original title
Inventory-Management-System-PHP: Unauthenticated SQL Injection in Login and Product Deletion
Original description
Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: $sql = "select * from user where email = '$email' and password = '$password'", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=1 LIMIT 1-- -. Separately, delete.php executes mysqli_query($db, "DELETE FROM product WHERE product_id=" . $_GET['id']) with no authentication check and no validation of the id parameter, allowing an unauthenticated attacker to delete arbitrary product rows or perform blind SQL injection via payloads such as id=0 OR SLEEP(5).
nvd CVSS3.1
9.8
Vulnerability type
CWE-89
SQL Injection
Published: 5 Aug 2026 · Updated: 5 Aug 2026 · First seen: 5 Aug 2026