code-projects Simple Inventory System Database Backup File inventorymanagement.sql information disclosure (code-projects Simple Inventory System)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.53 % · percentile 45 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- VulDB
- NVD status
- Deferred
Description
A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been published and may be used.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
- CWE-284 — Improper Access Control
References
- https://vuldb.com/vuln/397124
- https://vuldb.com/vuln/397124/cti
- https://vuldb.com/cve/CVE-2026-82624
- https://vuldb.com/submit/893401
- https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Sensitive%20Information%20Disclosure%20in%20Simple%20Inventory%20System%20PHP%20Exposed%20Database%20Backup.md
- https://code-projects.org/
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| CVSS 3.0 | MEDIUM 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR | VulDB |
| CVSS 4.0 | MEDIUM 5.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · cna@vuldb.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · cna@vuldb.com (Secondary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · cna@vuldb.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-68369
- GCVE · GCVE-0-2026-82624
Affected products
| Product | Versions |
|---|---|
| code-projects · Simple Inventory System | affected 1.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |