Stock Management System CVEs and Security Vulnerabilities

CVE-2026-71207

Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Swapnilsahu

Products

Stock Management System

CVE-2024-0958

CodeAstro Stock Management System Add Category index.php cross site scripting

A vulnerability was found in CodeAstro Stock Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /index.php of the component Add Category Handler. The manipulation of the argument Category Name/Category Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252203.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed