The vulnerability arises from missing authentication and authorization checks on state‑changing administrative handlers in the toner‑management application. Requests to add.php, edit.php, and delete.php under various admin subdirectories, such as admin/toners, admin/toner-brands, and admin/printers, can directly execute INSERT, UPDATE, or DELETE operations in the database. This allows an attacker to create, modify, or delete application data without any valid user credentials, severely compromising data integrity and exposing the system to accidental or malicious data loss or corruption.

The affected product is toner‑management from vendor raghav993. No specific version information is provided in the advisory.

The CVSS score of 8.2 classifies this flaw as a high‑severity vulnerability. The EPSS score is < 1%, indicating a very low but non‑zero exploitation probability. Since the issue is not listed in the CISA KEV catalog, the exploitation probability cannot be precisely quantified, but the absence of authentication implies a remote attacker can trigger the flaw by simply invoking the affected URLs. The vulnerability is exploitable without any valid user credentials or elevated privileges.