CVE-2026-82625: Cross Site Scripting in code-projects Simple Inventory System

This vulnerability in Simple Inventory System 1.0 allows an attacker to inject malicious scripts via the last_name argument in the /register.php user registration component, resulting in cross-site scripting (CWE-79). The attack vector is remote with no privileges required and no user interaction needed to initiate the attack, but user interaction is required to trigger it. The CVSS 3.1 base score is 5.3 (medium severity). There is no official patch or vendor advisory available, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions within the affected application. However, the attack requires user interaction to trigger the payload, which somewhat limits the impact.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's channels for updates. Until a fix is released, applying input validation and output encoding on the last_name parameter in /register.php can help mitigate the risk. Additionally, applying web application firewalls (WAF) rules to detect and block XSS payloads may reduce exposure.