CVE-2019-8404: Webiness Inventory Project Webiness Inventory

Medium severity, CVSS 6.5. EPSS: 7.9% chance of exploitation in the next 30 days.

An issue was discovered in Webiness Inventory 2.3. The ProductModel component allows Arbitrary File Upload via a crafted product image during the creation of a new product. Consequently, an attacker can steal information from the site with the help of an installed executable file, or change the contents of pages.

Affected products

• Webiness Inventory Project Webiness Inventory: version 2.3 only

Published 2019-05-14. Last modified 2026-06-17.