The vulnerability is located in the DBOperation.addCategory function of the AJAX Backend's process.php file. It allows an attacker to manipulate the userid argument so that no authentication check is performed, enabling the creation of categories without permission. The flaw is a classic authentication bypass (CWE‑287) and is exploitable from a remote source, and a public exploit has already been released.

Affected systems are all releases of the Rizwan17 inventory‑management‑system up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f, as the project uses a rolling‑release model that does not publish version numbers. The flaw resides in the AJAX Backend component, specifically within includes/process.php. Version information for a fixed release is not yet disclosed by the maintainers.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score is not available, suggesting limited publicly observed exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the vulnerability can be triggered remotely, an attacker could add unauthorized categories, potentially manipulating inventory data or subverting system integrity. The risk is heightened by the fact that a public exploit exists and the maintainers have not responded, so the flaw remains in the wild until an official patch is applied.