Vulnerability · Published Oct 19, 2026 · Assigned by VulDB

CVE-2026-112095SourceCodester Inventory System Product Management products_handler.php save cross site scripting

Low 3.5

In plain English

A low-severity cross-site scripting in Inventory System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.2%top 90.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the file /api/products_handler.php?action=save of the component Product Management. Executing a manipulation of the argument Product_Id/Product_Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.

Affected products (as reported)

Vendor	Product	Versions
SourceCodester	Inventory System	1.0

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-421919 | SourceCodester Inventory System Product Management products_handler.php save cross site scripting vdb-entry, technical-description
VDB-421919 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-112095 | CVE Analysis and Report third-party-advisory
Submit #1012164 | SourceCodester Inventory System 1.0 Cross Site Scripting third-party-advisory
https://github.com/Mohnad-AL-saif/MyCVEs/blob/main/VulDB/Inventory-System/CVE-01-XSS-products.md exploit
https://www.sourcecodester.com/ product