CVE-2026-118585 in inventariobasico
Summary
by MITRE • 10/29/2026
A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab. This vulnerability affects unknown code of the file addlist.php of the component Add Product Page. Such manipulation of the argument product name leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The identified vulnerability resides within the addlist.php file of the configuroweb inventariobasico application, specifically affecting the Add Product Page component. This security flaw is classified as a Cross-Site Scripting (XSS) vulnerability, which falls under CWE-79 in the Common Weakness Enumeration taxonomy. The root cause lies in insufficient input validation and sanitization of the product name argument passed to this specific endpoint. When an attacker supplies malicious script content within the product name field, the application fails to properly encode or escape these characters before rendering them back to the user interface. This allows arbitrary JavaScript code to execute in the context of a victim's browser session whenever they interact with data containing the injected payload.
From an operational perspective, this vulnerability enables remote attackers to launch attacks without requiring prior authentication if the affected page is accessible publicly, or it can be exploited against authenticated users who view product listings or details. The impact of such exploitation includes the theft of sensitive information such as session cookies, which could lead to account takeover and unauthorized access to administrative functions. Additionally, attackers may use this vector to deface the website by injecting malicious HTML content or redirecting victims to phishing sites designed to harvest credentials. Given that the exploit is publicly available, automated scanning tools and opportunistic attackers can easily leverage existing proof-of-concept code to compromise instances of this software without needing to develop custom exploits from scratch.
The development model of configuroweb inventariobasico utilizes a rolling release strategy, which means there are no discrete version numbers for affected or patched releases. This continuous delivery approach complicates traditional vulnerability management practices that rely on specific version comparisons to determine patch applicability. Organizations must therefore monitor the source code repository directly for fixes rather than relying on version-based updates. The project maintainers were notified of this issue through an official report but have not yet issued a response or provided a fix, leaving users in a state of prolonged exposure until remediation is implemented by the developers.
To mitigate the risks associated with this XSS vulnerability, immediate defensive measures should be prioritized since no patch exists. Input validation must be enforced on both client and server sides to ensure that only expected character sets are accepted for product names. Output encoding should be applied consistently when rendering user-supplied data in HTML contexts to prevent script execution. Furthermore, implementing a Content Security Policy (CSP) can significantly reduce the impact of successful XSS attacks by restricting the sources from which scripts can be loaded and executed. Network-level protections such as Web Application Firewalls may also help detect and block known exploit patterns associated with this vulnerability while organizations await an official resolution from the project maintainers.