The vulnerability arises from a lack of authentication and authorization checks on state‑changing administrative handlers in the toner‑management application. Requests to add.php, edit.php, and delete.php can directly execute INSERT, UPDATE, or DELETE operations in the database, allowing an attacker to create, modify, or destroy application data. This flaw results in a high‑severity compromise of data integrity, exposing the system to accidental or malicious data loss or corruption.

The affected product is toner-management from vendor raghav993. No specific version information is provided in the advisory.

The CVSS score of 8.2 classifies this flaw as a high‑severity vulnerability. Since no EPSS score is available and the issue is not listed in the CISA KEV catalog, the exploitation probability cannot be precisely quantified, but the absence of authentication implies a remote attacker can trigger the flaw by simply invoking the affected URLs. The vulnerability is exploitable without any valid user credentials or elevated privileges.