Threats tagged 'ghsa-3m74-xpcg-jfrw'

CVE-2026-90599 is a cross-site request forgery (CSRF) vulnerability in the Rizwan17 inventory-management-system affecting an unspecified function in includes/process.php. The flaw allows remote attackers to perform unauthorized actions via CSRF. The product uses rolling releases, so specific affected and fixed versions are not available. The vulnerability has a medium severity with a CVSS score of 5.3. The project has been notified but has not yet responded or issued a fix. Exploit code has been published, but no known active exploitation in the wild is reported.