CVE-2009-4596: Cross-site scripting (XSS) vulnerability in index.php in PHP Inventory 1.2 allows remote attackers to injec...

Security readout for executives and security teams

PHP Inventory 1.2 has a cross-site scripting issue in its supplier details page. An attacker could cause a user’s browser to run attacker-controlled script or HTML through the sup_id parameter. The bundle does not provide a CVSS score, patch version, or evidence of active exploitation. Exposure is likely limited to organizations still running PHP Inventory 1.2. Risk is higher if the application is reachable from the internet or used by privileged inventory administrators. The source bundle does not identify other affected versions or products. Treat as a legacy application exposure issue. Prioritize finding and isolating any PHP Inventory 1.2 instances, especially public-facing ones, but do not classify it as emergency without evidence of active exploitation or broad deployment. Mitigation focus: Identify any PHP Inventory 1.2 deployments.; Check vendor or project guidance for fixed versions or official patches.; Retire or isolate legacy PHP Inventory instances if no maintained fix exists..

Prepared

Jun 28, 2026, 09:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.