What’s Vulnerable › Vulnerabilities

CVE-2019-25443: Inventory Webapp SQL Injection via add-item.php

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-22 · updated 2026-06-17
• Weakness: CWE-89

Description

Inventory Webapp contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET parameters. Attackers can supply malicious SQL payloads in the name, description, quantity, or cat_id parameters to add-item.php to execute arbitrary database commands.

Affected products

• edlangley inventory-webapp: all versions

References

• https://www.exploit-db.com/exploits/47356
• https://www.vulncheck.com/advisories/inventory-webapp-sql-injection-via-add-itemphp

Get alerted when CVE-2019-25443 or the next vulnerability affects your stack