Vulnerability · Published Jun 8, 2026 · Assigned by VulDB

CVE-2026-11520SourceCodester Inventory System header.php cross site scripting

Low 3.5

In plain English

A low-severity cross-site scripting in Inventory System from SourceCodester. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.2%top 83.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in SourceCodester Inventory System 1.0. Affected by this issue is some unknown functionality of the file header.php. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Multiple parameters might be affected.

Affected products (as reported)

Vendor	Product	Versions
SourceCodester	Inventory System	1.0

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-369140 | SourceCodester Inventory System header.php cross site scripting vdb-entry
VDB-369140 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-11520 | CVE Analysis and Report third-party-advisory
Submit #836393 | SourceCodester Inventory System using PHP and MySQL Source Code 0 Cross Site Scripting third-party-advisory
https://www.sourcecodester.com/ product