CVE-2026-71248

Descrição

Inventory-Management-System-PHP-s login.php constructs its authentication query via direct string concatenation of raw POST parameters: = -select * from user where email = -- and password = ---, with no escaping or parameterization, allowing authentication bypass via a payload such as email=- OR 1=1 LIMIT 1-- -.