CVE-2026-71248 Inventory-Management-System-PHP - Unauthenticated SQL Injection in Login and Product Deletion

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select from user where email = '' and password = ''", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=...

PT-2026-68114

Name of the Vulnerable Software and Affected Versions Inventory-Management-System-PHP affected versions not specified Description The software contains SQL injection flaws in two separate components. The 'login.php' endpoint constructs authentication queries using direct string concatenation of r...

CVE-2026-71248: Improper Neutralization of Special Elements used in an SQL Command

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select from user where email = '' and password = ''", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=...