CVE-2026-87926 is a remote cross-site scripting vulnerability in the Rizwan17 inventory-management-system affecting the Login Page's index.php file. The flaw is due to improper processing of the 'msg' parameter, which can be manipulated to inject malicious scripts. The vulnerability allows an attacker to execute arbitrary scripts in the context of the victim's browser. The product lacks versioning, so precise affected versions are unknown. The vulnerability was responsibly disclosed but remains unpatched as of the latest information. Exploit code has been published, increasing the risk of exploitation.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary scripts in users' browsers, potentially leading to session hijacking, phishing, or other malicious actions within the context of the affected web application. The vulnerability requires user interaction (UI:P) and has no privileges or user consent required for the attacker (AV:N/PR:N). The overall impact is medium severity based on the CVSS 4.0 score of 5.3.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users and administrators should monitor the vendor's communications for updates. In the meantime, applying web application firewall (WAF) rules to detect and block malicious input targeting the 'msg' parameter may help mitigate exploitation risks. Avoid exposing the login page to untrusted networks if possible until a fix is released.