Description
A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Registration. Such manipulation of the argument last_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-08-31
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Apply Patch
AI Analysis

Impact

A stored cross‑site scripting vulnerability exists in the User Registration module of code‑projects Simple Inventory System 1.0. An attacker can submit a malicious value for the last_name field on /register.php; the payload is stored and later rendered without proper escaping, allowing arbitrary JavaScript to execute in the browsers of users who view the stored value.

Affected Systems

The flaw is present only in version 1.0 of code‑projects Simple Inventory System, specifically in the register.php endpoint of the User Registration component. No other versions or components are known to be affected.

Risk and Exploitability

The CVSS base score is 5.3, indicating moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The register.php endpoint is publicly reachable, so remote exploitation is possible. The description does not state that authentication or elevated privileges are required; based on that statement it is inferred that a user can supply the payload without logging in.

Generated by OpenCVE AI on August 31, 2026 at 09:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest release of Simple Inventory System that fixes the XSS issue.
  • Validate and escape the last_name input on the server side before storing or rendering it.
  • Implement or tighten a Content Security Policy to prevent the execution of injected scripts.

Generated by OpenCVE AI on August 31, 2026 at 09:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Registration. Such manipulation of the argument last_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Title code-projects Simple Inventory System User Registration register.php cross site scripting
First Time appeared Code-projects
Code-projects simple Inventory System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:code-projects:simple_inventory_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects simple Inventory System
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Simple Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-01T14:57:08.444Z

Reserved: 2026-08-30T08:12:17.284Z

Link: CVE-2026-82625

cve-icon Vulnrichment

Updated: 2026-09-01T14:57:00.806Z

cve-icon NVD

Status : Deferred

Published: 2026-08-31T07:17:47.120

Modified: 2026-09-01T15:17:35.540

Link: CVE-2026-82625

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T10:00:05Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')