Starnet Inventory Tracking Application: SQL injection lets attackers read database data

SQL injection (CWE-89) in Starnet Computer and Network Systems' Inventory Tracking Application, versions through 2026-10-16. The CNA (USOM) rates it network-reachable, no login needed, with high impact on confidentiality only, so an attacker could read the database. The vulnerable input and any fixed release are not published.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.5

high

scored by [email protected]

known so far3 of 6

missing: fix, primary source, exploitation

First public: Nov 2, 2026 UTC
Last modified: Nov 2, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-11-02 14:23 UTC. All times on this page are UTC.

Who is affected

1 product

Teams running Starnet Computer and Network Systems' Inventory Tracking Application with a build dated 2026-10-16 or earlier. The CVSS vector says it is reachable over the network with no login, so internet-exposed instances are most at risk. Anyone not using this product can skip it.

Product	Ecosystem	Affected	Fixed in
Inventory Tracking Application	vendor	through 2026-10-16	–

Who cares: inventory-tracking, starnet
Not affected if: –

How to check

unknown: the NVD entry gives only a date-based range (through 2026-10-16) and no vulnerable parameter
If you run Starnet's Inventory Tracking Application, check the build date with the vendor and ask Starnet for a fixed release

Starnet Inventory Tracking Application: SQL injection lets attackers read database data

Who is affected

How to check

The fix

Who had it, and when

Know the next one before it finds you.

Starnet Inventory Tracking Application: SQL injection lets attackers read database data

Who is affected

How to check

The fix

Who had it, and when

Know the next one before it finds you.

What the sources say, verbatim

Sources