CVE-2026-86211: SQL Injection in rabindralamsal inventory-management-system

The vulnerability CVE-2026-86211 affects rabindralamsal inventory-management-system version 1.0.0. It is an SQL injection flaw located in the Login component's index.php file. By manipulating the username or password arguments, an attacker can perform SQL injection remotely without any privileges or user interaction. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts. An exploit has been published, indicating potential risk, but no known active exploitation is reported. No patch or vendor advisory is currently available.

Successful exploitation allows an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is limited to confidentiality, integrity, and availability to a low degree as per the CVSS vector. Since the vulnerability is in the authentication component, it could affect user credential validation or session management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to apply web application firewall (WAF) rules to detect and block SQL injection attempts targeting the username and password parameters. Avoid exposing the vulnerable version in public-facing environments if possible.