CVE-2026-112096
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability was found in SourceCodester Inventory System 1.0 in the file /api/transactions_handler.php (action save_purchase) of the Purchase Records Handler. Manipulation of the Product_Name, Product_Code or Vendor_Name arguments leads to cross-site scripting. The attack can be performed remotely and the exploit has been publicly disclosed.
Risk Assessment
An attacker could inject a malicious script that executes in an administrator's or user's browser, potentially leading to session or data theft. The public availability of the exploit increases the risk of abuse.
Recommendation
Update the application to a non-vulnerable version or enforce input validation and encoding for the listed parameters. Until patched, restrict access to the API endpoint.
Other vulnerabilities in SourceCodester Inventory System
See all- CVE-2026-112097Low
A vulnerability was found in SourceCodester Inventory System 1.0 in unknown processing of /api/transactions_handler.php?action=save_sale within the sales management handler component. Manipulating the Hsn_Code argument results in cross-site scripting (XSS), and the attack can be launched remotely.
- CVE-2026-112095Low
A flaw was found in SourceCodester Inventory System 1.0 in the file /api/products_handler.php (action save) of the Product Management component. Manipulation of the Product_Id or Product_Name arguments can lead to cross-site scripting. The attack can be performed remotely and the exploit has been published.
- CVE-2026-11520Low
A cross-site scripting vulnerability was found in SourceCodester Inventory System 1.0 in the header.php file. Manipulation of unknown functionality allows remote attack. The exploit is publicly available.
- CVE-2026-11519Medium
A vulnerability in SourceCodester Inventory System 1.0 in the file /Product_Inventory/api/users_handler.php of the Account Creation Handler component allows manipulation of the ROLE argument, leading to improper authorization and remote attack.
- CVE-2026-11518Medium
SourceCodester Inventory System 1.0 has a cross-site scripting (XSS) vulnerability in /users.php (User Management Page) via the fullname and username parameters. The attack is remotely exploitable and the exploit is publicly available.
Original NVD description (English source)
A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactions_handler.php?action=save_purchase of the component Purchase Records Handler. The manipulation of the argument Product_Name/Product_Code/Vendor_Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS