CVE-2025-66417-POC

CVE-2025-66417 POC CVE-2025-66417 POST /front/inventory.php HTTP/1.1 Host: Accept-Encoding: gzip, deflate, br Accept: text/html Connection: keep-alive Content-Type: text/xml Content-Length: 429 getparams...

CVE-2026-47233

Admidio is an open-source user management solution. Version 5.0.9 added a missing "isAdministratorInventory" gate to "case 'itemdelete':" in "modules/inventory.php". The same fix was not applied to the sibling "case 'fielddelete':" handler, which destroys an entire inventory field definition,...

CVE-2026-47233: Missing Authorization

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...

CVE-2026-47689

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the "buildRow" method in "fogpage.class.php" substitutes data values into HTML table cell templates using "strreplace" without any HTML escaping. An unauthenticat...

CVE-2026-47687

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the "selectForm" helper in "fogpage.class.php" renders "" labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC...

CVE-2026-47685

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint "/service/inventory.php" persists client-supplied values without sanitization, and the Host Management Inventory pa...

CVE-2026-47689: Improper Neutralization of Input During Web Page Generation

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the buildRow method in fogpage.class.php substitutes data values into HTML table cell templates using strreplace without any HTML escaping. An unauthenticated...

CVE-2026-47687: Improper Neutralization of Input During Web Page Generation

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the selectForm helper in fogpage.class.php renders labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address...

CVE-2026-41658

Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces authorization for destructive operations delete, retire, reinstate only in the UI layer by conditionally rendering buttons. The backend POST handlers at modules/inventory.php for...

Exploit for CVE-2025-64516

CVE-2025-64516-POC POC SQLi CVE-2025-64516...

CVE-2022-3944 jerryhanjj ERP Commodity Management inventory.php uploadImages unrestricted upload

A vulnerability was found in jerryhanjj ERP. It has been declared as critical. Affected by this vulnerability is the function uploadImages of the file application/controllers/basedata/inventory.php of the component Commodity Management. The manipulation leads to unrestricted upload. The attack ca...

CVE-2021-25202

SQL injection vulnerability in SourceCodester Sales and Inventory System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to \ahira\admin\inventory.php...

Sql injection

SQL injection vulnerability in SourceCodester Sales and Inventory System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to \ahira\admin\inventory.php...

PT-2021-16454

Name of the Vulnerable Software and Affected Versions: SourceCodester Sales and Inventory System version 1.0 Description: The issue allows remote attackers to execute arbitrary SQL statements. This is achieved via the id parameter to the "/ahira/admin/inventory.php" API endpoint. Recommendations:...

CVE-2021-25202: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in SourceCodester Sales and Inventory System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to \ahira\admin\inventory.php...

BMW 'inventory.php"<= SQL Injection Vulnerability

No description provided by source. By: Dazz Email: Dazz.band at hotmail dot com email concealed ================================================ Script : Powered by Search Optics Automotive Internet Marketing example: http://www.example.com/inventory.php?t=N&viewID=3665819SQL...

BMW 'inventory.php"<= SQL Injection Vulnerability

By: Dazz Email: Dazz.band at hotmail dot com email concealed ================================================ Script : Powered by Search Optics Automotive Internet Marketing example: http://www.example.com/inventory.php?t=N&viewID=3665819SQL ================================================ WebSit...

The BMW inventory.php SQL Injection

Exploit for unknown platform in category web applications =================================== The BMW inventory.php SQL Injection =================================== ================================================ Script : Powered by Search Optics Automotive Internet Marketing example:...