---
id: "CVE-2026-118585"
kind: "vulnerability"
aliases: ["CVE-2026-118585"]
title: "configuroweb inventariobasico: product name field allows cross-site scripting"
severity: "medium"
cvss: 4.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "php", "self-hosted"]
not_affected_if: ["no-public-access"]
published_at: "2026-10-29T00:17:25+00:00"
first_seen_at: "2026-10-29T00:36:21+00:00"
updated_at: "2026-10-29T00:37:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118585", "first_seen_at": "2026-10-29T00:36:21+00:00"}]
---

# configuroweb inventariobasico: product name field allows cross-site scripting

An unpatched web inventory app lets an attacker inject script through the product name argument of addlist.php. The script runs in the browser of anyone who views the affected page, which can expose their session or actions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-29T00:36:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118585

## From the sources

A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab. This vulnerability affects unknown code of the file addlist.php of the component Add Product Page. Such manipulation of the argument product name leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_