# CVE-2026-118585: configuroweb inventariobasico Add Product addlist.php cross site scripting

Status: published. Published: 2026-10-28. Updated: 2026-11-03.

A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab. This vulnerability affects unknown code of the file addlist.php of the component Add Product Page. Such manipulation of the argument product name leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- configuroweb / inventariobasico: c9377cdba474deb3eb5a0704d197b5733af16b47 (affected); f9db0c0a04d79ad931c218140df4fb23809d4fab (affected). Source: CNA: VulDB

## Severity and prioritization

- CVSS 4.0: 5.1 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P; source: CNA: VulDB

- CVSS 3.1: 3.5 (low); CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C; source: CNA: VulDB

- CVSS 3.0: 3.5 (low); CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C; source: CNA: VulDB

- CVSS 2.0: 4 (medium); AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C; source: CNA: VulDB

- CISA KEV: No listing in collected sources

- EPSS: 0.20% as of 2026-11-02; percentile 9.68%

- SSVC: exploitation poc; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-79, CWE-94

## Exploit evidence

- exploit: https://github.com/configuroweb/inventariobasico/issues/1 (CNA: VulDB)

## References

- https://vuldb.com/vuln/428025 (CNA: VulDB; vdb-entry, technical-description)

- https://vuldb.com/vuln/428025/cti (CNA: VulDB; signature, permissions-required)

- https://vuldb.com/cve/CVE-2026-118585 (CNA: VulDB; third-party-advisory)

- https://vuldb.com/submit/1025899 (CNA: VulDB; third-party-advisory)

- https://github.com/configuroweb/inventariobasico/issues/1 (CNA: VulDB; exploit, issue-tracking)

- https://github.com/configuroweb/inventariobasico/ (CNA: VulDB; product)

## Provenance

- CNA: VulDB: https://www.cve.org/CVERecord?id=CVE-2026-118585; retrieved 2026-11-03; source updated 2026-11-03

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-118585; retrieved 2026-11-03; source updated Not reported

Revision: 13156c1987233e8e74aa6e900f6176a7e3ff27958b650304229ccf3c4bc5bddc

Canonical: https://y2.dev/cve/CVE-2026-118585

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.