{"id":"CVE-2026-112096","kind":"vulnerability","aliases":["CVE-2026-112096"],"related":[],"title":"SourceCodester Inventory System: stored XSS in purchase record fields","description":"A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactions_handler.php?action=save_purchase of the component Purchase Records Handler. The manipulation of the argument Product_Name/Product_Code/Vendor_Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.","summary":"The SourceCodester Inventory System 1.0 purchase records handler does not sanitize the Product_Name, Product_Code and Vendor_Name arguments on the save_purchase action. An attacker can inject script that runs in the browser of a user who views those records.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["inventory-system","other","php","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-19T09:17:07+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:42:00+00:00","updated_at":"2026-10-25T04:42:00+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:42:00Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"SourceCodester Inventory System: stored XSS in purchase record fields","impact":"medium","summary":"The SourceCodester Inventory System 1.0 purchase records handler does not sanitize the Product_Name, Product_Code and Vendor_Name arguments on the save_purchase action. An attacker can inject script that runs in the browser of a user who views those records.","category":"other","nicknames":[],"who_cares":["php","self-hosted","inventory-system"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Script runs in a staff member's browser, stealing session data.","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112096 for the affected version range and whether authentication is required, and look for a vendor or project fix.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running SourceCodester Inventory System 1.0 with the purchase records API reachable by users who can submit purchase data. The sources do not say whether a default install exposes this endpoint or whether a login is required. Deployments of other inventory software are not affected by this entry.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000568,"input_tokens":3349,"output_tokens":466,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112096':12A,15A '-2026':11A,14A '/api/transactions_handler.php':84C '1.0':28B,75C 'action':48B,85C 'affect':78C 'argument':43B,98C 'attack':50B,112C 'browser':58B 'code':39B,80C 'compon':90C 'cross':103C 'cve':10A,13A 'disclos':118C 'exploit':115C 'field':9A 'file':83C 'found':70C 'handler':31B,93C 'host':23B 'initi':110C 'inject':52B 'inventori':2A,17B,26B,73C 'inventory-system':16B 'lead':101C 'manipul':95C 'may':123C 'name':37B,42B 'name/product_code/vendor_name':100C 'php':20B 'possibl':108C 'product':36B,38B,99C 'public':121C 'purchas':7A,29B,47B,87C,91C 'record':8A,30B,65B,92C 'remot':113C 'run':55B 'sanit':34B 'save':46B,86C 'script':53B,105C 'self':22B 'self-host':21B 'site':104C 'sourcecodest':1A,25B,72C 'store':4A 'system':3A,18B,27B,74C 'unknown':79C 'use':125C 'user':61B 'vendor':41B 'view':63B 'vulner':67C,77C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Teams running SourceCodester Inventory System 1.0 with the purchase records API reachable by users who can submit purchase data. The sources do not say whether a default install exposes this endpoint or whether a login is required. Deployments of other inventory software are not affected by this entry.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T09:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112096","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112096","severity":null,"published_at":"2026-10-19T09:17:07+00:00","modified_at":"2026-10-19T17:17:12+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}