CVE-2026-112097
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability was found in SourceCodester Inventory System 1.0 in unknown processing of /api/transactions_handler.php?action=save_sale within the sales management handler component. Manipulating the Hsn_Code argument results in cross-site scripting (XSS), and the attack can be launched remotely.
Risk Assessment
A remote attacker can inject a malicious script that executes in the browser of a system user, potentially leading to session theft or actions on behalf of the victim. This may threaten data integrity and the security of system users.
Recommendation
Implement input validation and sanitization for the Hsn_Code argument and output escaping in the interface. Consider updating the system or applying vendor fixes if available.
Other vulnerabilities in SourceCodester Inventory System
See all- CVE-2026-112096Low
A vulnerability was found in SourceCodester Inventory System 1.0 in the file /api/transactions_handler.php (action save_purchase) of the Purchase Records Handler. Manipulation of the Product_Name, Product_Code or Vendor_Name arguments leads to cross-site scripting. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-112095Low
A flaw was found in SourceCodester Inventory System 1.0 in the file /api/products_handler.php (action save) of the Product Management component. Manipulation of the Product_Id or Product_Name arguments can lead to cross-site scripting. The attack can be performed remotely and the exploit has been published.
- CVE-2026-11520Low
A cross-site scripting vulnerability was found in SourceCodester Inventory System 1.0 in the header.php file. Manipulation of unknown functionality allows remote attack. The exploit is publicly available.
- CVE-2026-11519Medium
A vulnerability in SourceCodester Inventory System 1.0 in the file /Product_Inventory/api/users_handler.php of the Account Creation Handler component allows manipulation of the ROLE argument, leading to improper authorization and remote attack.
- CVE-2026-11518Medium
SourceCodester Inventory System 1.0 has a cross-site scripting (XSS) vulnerability in /users.php (User Management Page) via the fullname and username parameters. The attack is remotely exploitable and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactions_handler.php?action=save_sale of the component Sales Management Handler. The manipulation of the argument Hsn_Code results in cross site scripting. It is possible to launch the attack remotely.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS