CVE-2026-71207

The Stock-Inventory-Management-System application's login.php assigns raw $POST username/password values to $SESSION and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. An unauthenticated remote attacker can...