Description
A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-08-20
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw exists in the delete.php script of Simple Inventory System 1.0 that allows an attacker to inject arbitrary SQL through the ID parameter. This manipulation can expose, alter, or delete data stored in the underlying database, potentially compromising confidentiality and integrity of the application’s information.

Affected Systems

The vulnerability affects the code-projects Simple Inventory System, version 1.0 and any releases that have not applied the published fix. No other versions are explicitly mentioned in the data.

Risk and Exploitability

The CVSS score is 6.9, indicating a medium severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The attack can be performed remotely by delivering a crafted request containing a malicious ID value to /delete.php, which the application processes without proper sanitization. An attacker who succeeds could read sensitive data, alter records, or delete inventory entries.

Generated by OpenCVE AI on August 20, 2026 at 21:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Simple Inventory System to the latest release that includes parameterized queries for delete.php.
  • If a patch is not immediately available, apply input validation on the ID parameter, ensuring it is an integer and rejecting any non‑numeric values.
  • Refactor delete.php to use prepared statements or an ORM layer so that user input cannot be interpolated into SQL statements.
  • Limit the database user used by the web application to the minimum privileges required, avoiding full read/write access when possible.

Generated by OpenCVE AI on August 20, 2026 at 21:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Title code-projects Simple Inventory System delete.php sql injection
First Time appeared Code-projects
Code-projects simple Inventory System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:simple_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects simple Inventory System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Simple Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-20T14:29:51.019Z

Reserved: 2026-08-20T06:55:00.168Z

Link: CVE-2026-76990

cve-icon Vulnrichment

Updated: 2026-08-20T14:29:47.338Z

cve-icon NVD

Status : Deferred

Published: 2026-08-20T14:18:00.313

Modified: 2026-08-24T16:41:13.950

Link: CVE-2026-76990

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T13:01:48Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')