Vulnerability · Published Sep 9, 2026 · Assigned by VulDB

CVE-2026-87925Rizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injection

High 7.3

In plain English

A high-severity SQL injection in inventory-management-system from Rizwan17. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.4%top 62.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument pro_name[] results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
Rizwan17	inventory-management-system	bfe78a330d01bb26b9daec5dc9ecd5c77900e03f

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-401812 | Rizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injection vdb-entry, technical-description
VDB-401812 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-87925 | CVE Analysis and Report third-party-advisory
Submit #911138 | Rizwan17 inventory-management-system bfe78a330d01bb26b9daec5dc9ecd5c77900e03f SQL Injection third-party-advisory
https://github.com/Rizwan17/inventory-management-system/issues/13 exploit, issue-tracking
https://github.com/Rizwan17/inventory-management-system/ product