CVE-2026-11518
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
SourceCodester Inventory System 1.0 has a cross-site scripting (XSS) vulnerability in /users.php (User Management Page) via the fullname and username parameters. The attack is remotely exploitable and the exploit is publicly available.
Risk Assessment
A remote attacker can inject malicious scripts that execute in another user's browser, potentially leading to session theft or other attacks.
Recommendation
Update the system immediately or apply appropriate patching, and implement input validation.
Other vulnerabilities in SourceCodester Inventory System
See all- CVE-2026-11520Low
A cross-site scripting vulnerability was found in SourceCodester Inventory System 1.0 in the header.php file. Manipulation of unknown functionality allows remote attack. The exploit is publicly available.
- CVE-2026-11519Medium
A vulnerability in SourceCodester Inventory System 1.0 in the file /Product_Inventory/api/users_handler.php of the Account Creation Handler component allows manipulation of the ROLE argument, leading to improper authorization and remote attack.
Original NVD description (English source)
A vulnerability was identified in SourceCodester Inventory System 1.0. Affected is an unknown function of the file /users.php of the component User Management Page. The manipulation of the argument fullname/username leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.