these days you can open the devtools for the web-based inventory systems and start sending malicious events straight from the console. filed as not-a-bug...