# CVE-2026-82624: code-projects Simple Inventory System information disclosure in database backup

Source: https://junglewise.ai/threats/cve-2026-82624-code-projects-simple-inventory-system-information-disclosure-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82624 · Severity: medium · CVSS 5.3 · Published 2026-08-31

code-projects Simple Inventory System is a free open-source inventory management application. A flaw in the Database Backup File Handler allows the sensitive inventorymanagement.sql file to be accessed remotely without proper authentication, exposing database contents including potentially sensitive business data, user credentials, and customer information.

Technologies: [Code-Projects Simple Inventory System](https://junglewise.ai/threats/technologies/simple-inventory-system). Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-82624 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82624 being exploited in the wild.

**How severe is CVE-2026-82624?** Medium severity, with a CVSS score of 5.3, published 31 August 2026.

**Which products and versions are affected?** Code-Projects Simple Inventory System 1.0.

**Is there a fix for CVE-2026-82624?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82624 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82624?** Check whether you run Code-Projects Simple Inventory System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an information disclosure flaw in the Database Backup File Handler component of Simple Inventory System 1.0. The inventorymanagement.sql database backup file is exposed and accessible via network without authentication, likely due to misconfiguration or inadequate access controls on the backup file location. An attacker can remotely retrieve the complete SQL database dump, which may contain sensitive data such as user credentials, business records, and transaction history. The exploit is publicly available and requires no special privileges or user interaction to execute. Patch availability is not documented in the advisory.

## Affected products

- code-projects Simple Inventory System 1.0

## Timeline

- 2026-08-31: disclosed
- exploited: exploit published and may be used

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Sensitive%20Information%20Disclosure%20in%20Simple%20Inventory%20System%20PHP%20Exposed%20Database%20Backup.md](https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Sensitive%20Information%20Disclosure%20in%20Simple%20Inventory%20System%20PHP%20Exposed%20Database%20Backup.md)

## Related threats

- [code-projects Simple Inventory System cross-site scripting in user registration](https://junglewise.ai/threats/cve-2026-82625-code-projects-simple-inventory-system-cross-site-scripting-in)
- [code-projects Simple Inventory System SQL injection in edit.php](https://junglewise.ai/threats/cve-2026-79845-code-projects-simple-inventory-system-sql-injection-in-edit-php)
- [code-projects Simple Inventory System SQL injection in delete.php](https://junglewise.ai/threats/cve-2026-76990-code-projects-simple-inventory-system-sql-injection-in-delete-php)