Live › vulnerability › CVE-2026-112095
Go to dashboardSourceCodester Inventory System 1.0 does not sanitize the Product_Id and Product_Name arguments sent to /api/products_handler.php?action=save. A remote attacker can inject script that runs in the browser of anyone who views the affected product data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the SourceCodester Inventory System 1.0 PHP application with the Product Management module reachable by users. The exposure depends on the product save endpoint accepting input from remote users and on the product data being rendered in a browser. Teams that do not run this application can skip it.
No product ranges from the sources yet.
/api/products_handler.php on the hostapi/products_handler.php for how Product_Id and Product_Name are output without escapingEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the file /api/products_handler.php?action=save of the component Product Management. Executing a manipulation of the argument Product_Id/Product_Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-112095")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.