The Simple Inventory System 1.0 contains a flaw in the edit.php script that allows manipulation of the ID parameter to inject arbitrary SQL statements. This is a classic injection vulnerability that can let an attacker read, modify, or delete inventory records stored in the database. The result is loss of confidentiality, integrity, and potentially availability of business data.

Any installation of code-projects Simple Inventory System version 1.0 that includes the edit.php page is impacted. The vulnerability is tied to the specific code executing the ID variable and is not indicated to affect other versions or modules beyond this file.

The CVSS score of 6.9 indicates moderate to high risk, and attackers can reach the flaw remotely via standard HTTP requests to edit.php. The EPSS score is not reported, but publicly available proof‑of‑concept exploits suggest that the likelihood of exploitation is non‑negligible. The vulnerability is not yet listed in the CISA KEV catalog, yet it is present in multiple vulnerability databases, underscoring its relevance to administrators.