GHSA-G3F9-G5VJ-P62F Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization through the stockAction process in the VariantStock component when the variant property is not locked, allowing client-side manipulation of the variant ID. An attacker can modify inventory levels for any product...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37989)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from the improper validation of the companyname parameter in the /pages/suptransac.php file...

CVE-2026-90456: Use of Default Credentials

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37986)

Sales and Inventory System is an enterprise resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from the failure to properly validate the ID parameter in the /pages/settings Edit.php...

PT-2026-90525

Name of the Vulnerable Software and Affected Versions Inventory Management Component affected versions not specified Description An example environment-configuration file for a bundled inventory-management component contains a fixed, publicly-known administrative password. If this example file is...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37988)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the improper handling of the Username parameter in the /pages/ustransac.p...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37987)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the improper filtering of the ID parameter in the /pages/emp Edit1.php...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37983)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability arises from the failure of the /pages/custedit1.php file to properly validate the ID...

PT-2026-90545

Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37984)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability arises from the failure of the /pages/prosearchfrm.php file to properly validate the...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37985)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability arises from the failure to properly validate the user ID parameter input in the...

EUVD-2026-75219

A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument proname results in sql injection. The...

EUVD-2026-75211

A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is some unknown functionality of the file includes/DBOperation.php of the component List Handler. This manipulation of the argument...

EUVD-2026-75213

A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affects an unknown part of the file includes/invoicebill.php of the component Invoice Generation. Such manipulation of the argument orderdate/invoiceno leads to...

EUVD-2026-75220

A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the file index.php of the component Login Page. Executing a manipulation of the argument msg can lead to cross site scripting. The attack can...

EUVD-2026-75189

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument useri...

EUVD-2026-75182

A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function updaterecord of the file includes/manage.php. The manipulation of the argument updatecategory/cid/updatebrand/updateproduct leads to sql injection. The...

CVE-2026-87925

A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument proname results in sql injection. The...

CVE-2026-87926

A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the file index.php of the component Login Page. Executing a manipulation of the argument msg can lead to cross site scripting. The attack can...