CVE-2026-112095
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A flaw was found in SourceCodester Inventory System 1.0 in the file /api/products_handler.php (action save) of the Product Management component. Manipulation of the Product_Id or Product_Name arguments can lead to cross-site scripting. The attack can be performed remotely and the exploit has been published.
Risk Assessment
A malicious script could execute in a user's browser, risking session hijacking or data modification. The public exploit increases the likelihood of attack.
Recommendation
Update the application to a patched version or enforce input validation and encoding for the specified parameters. Consider restricting access to the endpoint until updated.
Other vulnerabilities in SourceCodester Inventory System
See all- CVE-2026-112097Low
A vulnerability was found in SourceCodester Inventory System 1.0 in unknown processing of /api/transactions_handler.php?action=save_sale within the sales management handler component. Manipulating the Hsn_Code argument results in cross-site scripting (XSS), and the attack can be launched remotely.
- CVE-2026-112096Low
A vulnerability was found in SourceCodester Inventory System 1.0 in the file /api/transactions_handler.php (action save_purchase) of the Purchase Records Handler. Manipulation of the Product_Name, Product_Code or Vendor_Name arguments leads to cross-site scripting. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-11520Low
A cross-site scripting vulnerability was found in SourceCodester Inventory System 1.0 in the header.php file. Manipulation of unknown functionality allows remote attack. The exploit is publicly available.
- CVE-2026-11519Medium
A vulnerability in SourceCodester Inventory System 1.0 in the file /Product_Inventory/api/users_handler.php of the Account Creation Handler component allows manipulation of the ROLE argument, leading to improper authorization and remote attack.
- CVE-2026-11518Medium
SourceCodester Inventory System 1.0 has a cross-site scripting (XSS) vulnerability in /users.php (User Management Page) via the fullname and username parameters. The attack is remotely exploitable and the exploit is publicly available.
Original NVD description (English source)
A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the file /api/products_handler.php?action=save of the component Product Management. Executing a manipulation of the argument Product_Id/Product_Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS