CVE-2026-5810
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A cross-site scripting vulnerability was found in SourceCodester Sales and Inventory System 1.0 in the /delete.php file of the GET Parameter Handler component. Manipulation of the ID argument allows remote XSS attacks. The exploit has been published.
Risk Assessment
An attacker can inject malicious scripts that execute in the victim's browser, leading to session theft, redirects, or data theft.
Recommendation
Immediately update the system to a patched version or apply input filtering for the ID parameter.
Original NVD description (English source)
A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /delete.php of the component GET Parameter Handler. This manipulation of the argument ID causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used.