The Inventory-Management-System-PHP's login.php file builds an SQL query for user authentication by concatenating user-supplied email and password parameters directly into the query string without sanitization or parameterization. This results in a classic SQL Injection vulnerability (CWE-89) that can be exploited to bypass authentication controls by injecting a payload that always evaluates to true, such as email=' OR 1=1 LIMIT 1-- -. The vulnerability is publicly known and assigned CVE-2026-71248 with a critical CVSS 3.1 score of 9.8. No official remediation or patch information is currently available.

Successful exploitation allows an unauthenticated attacker to bypass login authentication, potentially gaining unauthorized access to the system with full privileges. This compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to implement input validation and use parameterized queries or prepared statements to prevent SQL Injection. Avoid direct concatenation of user input into SQL queries.