Live › vulnerability › CVE-2026-118585
Go to dashboardAn unpatched web inventory app lets an attacker inject script through the product name argument of addlist.php. The script runs in the browser of anyone who views the affected page, which can expose their session or actions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 00:36 UTC. All times on this page are UTC.
Teams that run configuroweb inventariobasico with the Add Product Page exposed to users. The sources name specific commits but no version, and the project has not responded to the report, so no fixed release is known. Installations where the add-product form is not reachable can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab. This vulnerability affects unknown code of the file addlist.php of the component Add Product Page. Such manipulation of the argument product name leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-118585")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.