CVE-2026-82625: Cross Site Scripting in code-projects Simple Inventory System

This vulnerability in code-projects Simple Inventory System 1.0 allows an attacker to perform cross-site scripting by manipulating the last_name parameter in the /register.php user registration component. The attack vector is remote with no privileges required, but user interaction is necessary. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the potential for limited impact due to the requirement of user interaction and lack of elevated privileges. There is no vendor-provided patch or official remediation level indicated in the available data. Exploit details have been publicly disclosed, but no known active exploitation in the wild has been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application for users who interact with the malicious input. This may lead to session hijacking, defacement, or other client-side impacts typical of XSS vulnerabilities. However, the attack requires user interaction and does not grant elevated privileges or direct system compromise.

No official patch or remediation guidance is currently available from the vendor. Users of code-projects Simple Inventory System 1.0 should apply general XSS mitigations such as input validation and output encoding on the last_name parameter in /register.php. Monitor vendor channels for updates or official fixes. Until a patch is released, consider restricting access to the registration functionality or employing web application firewalls to detect and block malicious input targeting this parameter.