CVE-2026-13568
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A vulnerability has been found in SourceCodester Inventory Management System 1.0 in the file /api/users_handler.php of the User Registration Endpoint. Manipulation of the role argument leads to improper access controls, allowing remote exploitation.
Risk Assessment
The organization is at risk of unauthorized privilege changes, potentially leading to privilege escalation and system compromise.
Recommendation
Update the system to the latest version or apply the vendor's security patch immediately. Until then, restrict access to the /api/users_handler.php file.
Other vulnerabilities in SourceCodester Inventory Management System
See all- CVE-2026-13570Low
A cross-site scripting vulnerability was found in SourceCodester Inventory Management System 1.0 in the file /api/users_handler.php. Manipulating the full_name argument in the user registration endpoint allows remote script execution. The exploit is publicly available.
- CVE-2023-4749Medium
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'page' argument in the index.php file leads to file inclusion, allowing for remote attacks.
- CVE-2023-4558Medium
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the argument columns[0][data] in the staff_data.php file leads to SQL injection, which can be executed remotely.
- CVE-2023-4557Medium
A critical vulnerability has been found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'customer' argument in the file app/ajax/search_purchase_paymen_report.php leads to SQL injection.
- CVE-2023-4555Low
A vulnerability has been identified in SourceCodester Inventory Management System version 1.0 that allows cross site scripting (XSS) attacks through manipulation of the name/company argument in the suppliar_data.php file. The attack can be launched remotely.
- CVE-2023-4438Medium
A critical vulnerability has been identified in SourceCodester Inventory Management System version 1.0. Manipulation of the 'customer' argument in the app/ajax/search_sales_report.php file leads to SQL injection, allowing for remote attacks.
- CVE-2023-4437Medium
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'customer' argument in the file app/ajax/search_sell_paymen_report.php leads to SQL injection, allowing for remote attacks.
- CVE-2023-4436Medium
A critical vulnerability has been found in SourceCodester Inventory Management System 1.0, affecting some unknown processing of the file app/action/edit_update.php. Manipulation of the argument user_id leads to SQL injection.
- CVE-2023-4201Medium
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. The issue affects some unknown processing of the file ex_catagory_data.php, leading to SQL injection.
- CVE-2023-4200Medium
A critical vulnerability has been found in SourceCodester Inventory Management System version 1.0. Manipulation of the argument columns[1][data] leads to SQL injection, which can be exploited remotely.
Original NVD description (English source)
A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability affects unknown code of the file /api/users_handler.php of the component User Registration Endpoint. This manipulation of the argument role causes improper access controls. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.