CVE-2026-11520
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A cross-site scripting vulnerability was found in SourceCodester Inventory System 1.0 in the header.php file. Manipulation of unknown functionality allows remote attack. The exploit is publicly available.
Risk Assessment
An attacker can inject malicious scripts, leading to session theft, redirects, or data theft from users.
Recommendation
Update the system to the latest version or apply a patch that prevents XSS.
Other vulnerabilities in SourceCodester Inventory System
See all- CVE-2026-11519Medium
A vulnerability in SourceCodester Inventory System 1.0 in the file /Product_Inventory/api/users_handler.php of the Account Creation Handler component allows manipulation of the ROLE argument, leading to improper authorization and remote attack.
- CVE-2026-11518Medium
SourceCodester Inventory System 1.0 has a cross-site scripting (XSS) vulnerability in /users.php (User Management Page) via the fullname and username parameters. The attack is remotely exploitable and the exploit is publicly available.
Original NVD description (English source)
A weakness has been identified in SourceCodester Inventory System 1.0. Affected by this issue is some unknown functionality of the file header.php. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Multiple parameters might be affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS