Is CVE-2026-76990 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76990 being exploited in the wild.

How severe is CVE-2026-76990?

High severity, with a CVSS score of 7.3, published 20 August 2026.

Which products and versions are affected?

Code-Projects Simple Inventory System 1.0.

Is there a fix for CVE-2026-76990?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-76990 attacked?

It is attacked over the network.

Am I affected by CVE-2026-76990?

Check whether you run Code-Projects Simple Inventory System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76990: code-projects Simple Inventory System SQL injection in delete.php

CVE-2026-76990 · Severity: high · CVSS 7.3 · Published 2026-08-20

Simple Inventory System is an open-source PHP application used to manage product inventory. The application is vulnerable to SQL injection in the delete functionality, allowing an unauthenticated attacker to extract sensitive data from the database, including user credentials, and read arbitrary files from the server. This could lead to complete compromise of the inventory system and exposure of business data and user information.

Technologies: Code-Projects Simple Inventory System. Vendors: Code-Projects.

Quick answers

Is CVE-2026-76990 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76990 being exploited in the wild.
How severe is CVE-2026-76990?: High severity, with a CVSS score of 7.3, published 20 August 2026.
Which products and versions are affected?: Code-Projects Simple Inventory System 1.0.
Is there a fix for CVE-2026-76990?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76990 attacked?: It is attacked over the network.
Am I affected by CVE-2026-76990?: Check whether you run Code-Projects Simple Inventory System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A boolean-based blind SQL injection vulnerability exists in /InventoryManagement/delete.php where the unsanitized GET parameter "id" is directly concatenated into a SQL DELETE query. No authentication is required to exploit this vulnerability, and it is accessible over the network. An attacker can craft malicious SQL payloads in the id parameter to enumerate the database schema, extract sensitive data (including credentials), and leverage database FILE privileges to read arbitrary files from the server filesystem. The vulnerability stems from missing input validation and failure to use parameterized queries. Remediation involves implementing prepared statements with bound parameters and applying strict input validation.

Affected products

code-projects Simple Inventory System 1.0

Timeline

2026-08-20: disclosed: Vulnerability publicly disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.