Live › vulnerability › CVE-2026-112096
Go to dashboardThe SourceCodester Inventory System 1.0 purchase records handler does not sanitize the Product_Name, Product_Code and Vendor_Name arguments on the save_purchase action. An attacker can inject script that runs in the browser of a user who views those records.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running SourceCodester Inventory System 1.0 with the purchase records API reachable by users who can submit purchase data. The sources do not say whether a default install exposes this endpoint or whether a login is required. Deployments of other inventory software are not affected by this entry.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactions_handler.php?action=save_purchase of the component Purchase Records Handler. The manipulation of the argument Product_Name/Product_Code/Vendor_Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-112096")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.