---
id: CVE-2026-87922
title: >-
  A security flaw has been discovered in Rizwan17 inventory-management-system up
  to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f
summary: >-
  A security flaw has been discovered in Rizwan17 inventory-management-system up
  to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is
  the function DBOperation.addCategory of the file includes/process.php of the
  co…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-287
  - CWE-306
vendor: Rizwan17
product: inventory-management-system
affected:
  - inventory-management-system bfe78a330d01bb26b9daec5dc9ecd5c77900e03f
published: '2026-09-09'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T15:17:54.387'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87922'
references:
  - url: 'https://github.com/Rizwan17/inventory-management-system/'
    label: cna@vuldb.com
  - url: 'https://github.com/Rizwan17/inventory-management-system/issues/10'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-87922'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/911128'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/401809'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/401809/cti'
    label: cna@vuldb.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-10T14:52:53.035793Z'
ingestedAt: '2026-09-13T16:08:07.888Z'
epss: 0.00686
epssPercentile: 0.50603
---

## Overview

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument userid results in missing authentication. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.