CVE-2026-90694
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability in SourceCodester Inventory Management System 1.0 affects an unknown function of the file /api/customers_handler.php of the Customer Management Module. Manipulation of the Customer_Name argument leads to cross site scripting. The attack can be executed remotely, and the exploit has been disclosed to the public.
Risk Assessment
A remote attacker can execute an XSS attack, potentially leading to session theft or execution of malicious code in the victim's browser.
Recommendation
Apply appropriate patches or update the system to a version that fixes this vulnerability.
Other vulnerabilities in SourceCodester Inventory Management System
See all- CVE-2026-13570Low
A cross-site scripting vulnerability was found in SourceCodester Inventory Management System 1.0 in the file /api/users_handler.php. Manipulating the full_name argument in the user registration endpoint allows remote script execution. The exploit is publicly available.
- CVE-2026-90697Medium
A vulnerability was identified in an unknown part of invoice.php in SourceCodester Inventory Management System 1.0. Manipulation of the ID argument leads to authorization bypass, and the attack can be launched remotely. The exploit is publicly available.
- CVE-2026-90696Low
A vulnerability in SourceCodester Inventory Management System 1.0 affects an unknown functionality of the file /api/products_handler.php of the Product Management Module. Manipulation of the Product_Name argument leads to cross site scripting. The attack may be performed remotely, and the exploit has been publicly disclosed.
- CVE-2026-90695Low
A vulnerability in SourceCodester Inventory Management System 1.0 affects an unknown functionality of the file /api/vendors_handler.php of the Vendor Management component. Manipulation results in cross site scripting. The attack is possible to be carried out remotely, and the exploit has been made public.
- CVE-2026-13568High
A vulnerability has been found in SourceCodester Inventory Management System 1.0 in the file /api/users_handler.php of the User Registration Endpoint. Manipulation of the role argument leads to improper access controls, allowing remote exploitation.
- CVE-2023-4749Medium
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'page' argument in the index.php file leads to file inclusion, allowing for remote attacks.
- CVE-2023-4558Medium
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the argument columns[0][data] in the staff_data.php file leads to SQL injection, which can be executed remotely.
- CVE-2023-4557Medium
A critical vulnerability has been found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'customer' argument in the file app/ajax/search_purchase_paymen_report.php leads to SQL injection.
- CVE-2023-4555Low
A vulnerability has been identified in SourceCodester Inventory Management System version 1.0 that allows cross site scripting (XSS) attacks through manipulation of the name/company argument in the suppliar_data.php file. The attack can be launched remotely.
- CVE-2023-4438Medium
A critical vulnerability has been identified in SourceCodester Inventory Management System version 1.0. Manipulation of the 'customer' argument in the app/ajax/search_sales_report.php file leads to SQL injection, allowing for remote attacks.
Original NVD description (English source)
A vulnerability has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file /api/customers_handler.php of the component Customer Management Module. Such manipulation of the argument Customer_Name leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS