CVE-2026-71248

CriticalCVSS 9.8

Published: 05/08/2026(UTC)Updated: 10/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

The vulnerability in login.php of Inventory-Management-System-PHP consists of constructing the authentication query by directly concatenating raw POST parameters, without any escaping or parameterization. This allows authentication bypass via SQL injection, e.g., email=' OR 1=1 LIMIT 1-- -.

Risk Assessment

An unauthenticated attacker can gain access to the login panel and take over user accounts, potentially leading to data theft or full system compromise.

Recommendation

Immediately use parameterized queries (prepared statements) or proper input escaping in login.php. Additionally, implement validation and sanitization of all user-supplied data.

Original NVD description (English source)

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select * from user where email = '' and password = ''", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=1 LIMIT 1-- -.