{"id":"CVE-2026-112095","kind":"vulnerability","aliases":["CVE-2026-112095"],"related":[],"title":"SourceCodester Inventory System: stored XSS in product save handler","description":"A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the file /api/products_handler.php?action=save of the component Product Management. Executing a manipulation of the argument Product_Id/Product_Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.","summary":"SourceCodester Inventory System 1.0 does not sanitize the Product_Id and Product_Name arguments sent to /api/products_handler.php?action=save. A remote attacker can inject script that runs in the browser of anyone who views the affected product data.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["inventory-system","package","php","self-hosted","sourcecodester"],"not_affected_if":["no-product-management-module","not-deployed"],"how_to_check":"- Confirm whether the application is deployed: look for `/api/products_handler.php` on the host\n- Review `api/products_handler.php` for how `Product_Id` and `Product_Name` are output without escaping\n- unknown for version-specific checks","fix":"- unknown: the sources do not name a patched release or vendor fix\n- Until a fix exists, restrict access to the inventory application to trusted users and escape output of product fields","status":"open","published_at":"2026-10-19T09:17:07+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:42:01+00:00","updated_at":"2026-10-25T04:42:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:42:01Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a patched release or vendor fix\n- Until a fix exists, restrict access to the inventory application to trusted users and escape output of product fields","reach":"internet","title":"SourceCodester Inventory System: stored XSS in product save handler","impact":"medium","summary":"SourceCodester Inventory System 1.0 does not sanitize the Product_Id and Product_Name arguments sent to /api/products_handler.php?action=save. A remote attacker can inject script that runs in the browser of anyone who views the affected product data.","category":"package","nicknames":[],"who_cares":["php","inventory-system","sourcecodester","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"script runs in other users' browsers within the inventory app","analyst_note":"Check the NVD entry and any linked exploit or vendor page to confirm whether authentication is required and whether a fixed version exists.","how_to_check":"- Confirm whether the application is deployed: look for `/api/products_handler.php` on the host\n- Review `api/products_handler.php` for how `Product_Id` and `Product_Name` are output without escaping\n- unknown for version-specific checks","needs_analyst":true,"not_affected_if":["not-deployed","no-product-management-module"],"who_is_affected":"Teams running the SourceCodester Inventory System 1.0 PHP application with the Product Management module reachable by users. The exposure depends on the product save endpoint accepting input from remote users and on the product data being rendered in a browser. Teams that do not run this application can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000624,"input_tokens":3316,"output_tokens":584,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112095':12A,15A '-2026':11A,14A '/api/products_handler.php':41B,81C '1.0':28B,72C 'action':42B,82C 'affect':60B,74C 'anyon':56B 'argument':38B,94C 'attack':46B,104C 'browser':54B 'compon':86C 'cross':100C 'cve':10A,13A 'data':62B 'execut':89C 'exploit':111C 'file':80C 'flaw':64C 'found':67C 'handler':9A 'host':23B 'id':34B 'id/product_name':96C 'inject':48B 'inventori':2A,17B,26B,70C 'inventory-system':16B 'lead':98C 'manag':88C 'manipul':91C 'may':105C,116C 'name':37B 'packag':19B 'part':77C 'perform':107C 'php':20B 'product':7A,33B,36B,61B,87C,95C 'publish':114C 'remot':45B,109C 'run':51B 'sanit':31B 'save':8A,43B,83C 'script':49B,102C 'self':22B 'self-host':21B 'sent':39B 'site':101C 'sourcecodest':1A,24B,25B,69C 'store':4A 'system':3A,18B,27B,71C 'unknown':76C 'use':118C 'view':58B 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Teams running the SourceCodester Inventory System 1.0 PHP application with the Product Management module reachable by users. The exposure depends on the product save endpoint accepting input from remote users and on the product data being rendered in a browser. Teams that do not run this application can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T09:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112095","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112095","severity":null,"published_at":"2026-10-19T09:17:07+00:00","modified_at":"2026-10-22T03:16:35+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}