Live › vulnerability › CVE-2026-112097
Go to dashboardThe Sales Management handler of SourceCodester Inventory System 1.0 does not sanitize the Hsn_Code argument sent to /api/transactions_handler.php?action=save_sale. An attacker can inject script that runs in the browser of a user who views the affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of SourceCodester Inventory System 1.0 that expose the sales save endpoint to users. The sources do not say whether a default install is affected or whether the flaw needs a logged-in session. Teams running a different product or a patched copy can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactions_handler.php?action=save_sale of the component Sales Management Handler. The manipulation of the argument Hsn_Code results in cross site scripting. It is possible to launch the attack remotely.
This page as .md · .json · in your agent: get_signal("CVE-2026-112097")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.