CVE-2026-62116: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Dmitry V. Barcode Scanner with Inventory & Order Manager

This vulnerability, identified as CWE-79, involves improper neutralization of input during web page generation in the Barcode Scanner with Inventory & Order Manager software by Dmitry V. Versions up to and including 1.13.1 are affected. The flaw allows unauthenticated attackers to perform cross-site scripting (XSS) attacks, potentially leading to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected application, potentially resulting in partial loss of confidentiality, integrity, and availability. The CVSS score of 7.1 reflects a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Users should monitor vendor communications for updates and consider implementing input validation or web application firewalls as interim mitigations.