CVE-2026-118585

LOW 3.5

configuroweb inventariobasico Add Product addlist.php cross site scripting

CVSS Score

3.5

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab. This vulnerability affects unknown code of the file addlist.php of the component Add Product Page. Such manipulation of the argument product name leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-79 CWE-94
Vendor	configuroweb
Product	inventariobasico
Published	Oct 28, 2026

Stay Ahead of the Next One

Get instant alerts for configuroweb inventariobasico

Be the first to know when new low vulnerabilities affecting configuroweb inventariobasico are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

configuroweb / inventariobasico

c9377cdba474deb3eb5a0704d197b5733af16b47 f9db0c0a04d79ad931c218140df4fb23809d4fab

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/428025 vuldb.com: https://vuldb.com/vuln/428025/cti vuldb.com: https://vuldb.com/cve/CVE-2026-118585 vuldb.com: https://vuldb.com/submit/1025899 github.com: https://github.com/configuroweb/inventariobasico/issues/1 github.com: https://github.com/configuroweb/inventariobasico/

Credits

🔍 dexter-morgan (VulDB User) VulDB CNA Team