CVE-2026-71248 — Inventory-Management-System-PHP - Unauthenticated SQL Injection in Login and Product Deletion
Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select * from user where email = '' an…
Published: 2026-08-05 · CVSS: 9.8 · CVSS 3.1
Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select * from user where email = '' and password = ''", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=1 LIMIT 1-- -.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7