CVE-2026-71207
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path.
Risk Assessment
Risk of full compromise of the application and database by an attacker, potentially leading to confidentiality, integrity, and availability breaches.
Recommendation
Immediately change the hardcoded admin credentials and use parameterized SQL queries. Additionally, implement authentication mechanisms based on secure practices.
Original NVD description (English source)
The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path.