CVE-2026-79845: SQL Injection in code-projects Simple Inventory System

This vulnerability affects code-projects Simple Inventory System version 1.0. It arises from improper sanitization of the ID argument in the /InventoryManagement/edit.php file, allowing an attacker to perform SQL injection remotely. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and partial impacts on confidentiality, integrity, and availability. Exploit code is publicly available, but there is no vendor advisory or official remediation information provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with partial confidentiality, integrity, and availability impacts. No evidence of active exploitation in the wild is reported.

No official patch or remediation guidance is currently available. Users should monitor the vendor's advisories for updates. Until a fix is released, restricting access to the affected endpoint and implementing web application firewall rules to detect and block SQL injection attempts may help mitigate risk.