{"id":"CVE-2026-112097","kind":"vulnerability","aliases":["CVE-2026-112097"],"related":[],"title":"SourceCodester Inventory System: Hsn_Code parameter enables cross-site scripting","description":"A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactions_handler.php?action=save_sale of the component Sales Management Handler. The manipulation of the argument Hsn_Code results in cross site scripting. It is possible to launch the attack remotely.","summary":"The Sales Management handler of SourceCodester Inventory System 1.0 does not sanitize the Hsn_Code argument sent to /api/transactions_handler.php?action=save_sale. An attacker can inject script that runs in the browser of a user who views the affected page.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["inventory-system","other","php","self-hosted"],"not_affected_if":["other-product"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-19T09:17:07+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:29:10+00:00","updated_at":"2026-10-25T04:29:10+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:29:10Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"SourceCodester Inventory System: Hsn_Code parameter enables cross-site scripting","impact":"medium","summary":"The Sales Management handler of SourceCodester Inventory System 1.0 does not sanitize the Hsn_Code argument sent to /api/transactions_handler.php?action=save_sale. An attacker can inject script that runs in the browser of a user who views the affected page.","category":"other","nicknames":[],"who_cares":["php","self-hosted","inventory-system"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Script runs in a user's browser within the inventory app","analyst_note":"Check the NVD entry for the auth requirement and whether a vendor or patched version exists; the sources give no fix.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["other-product"],"who_is_affected":"Deployments of SourceCodester Inventory System 1.0 that expose the sales save endpoint to users. The sources do not say whether a default install is affected or whether the flaw needs a logged-in session. Teams running a different product or a patched copy can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000553,"input_tokens":3312,"output_tokens":443,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112097':14A,17A '-2026':13A,16A '/api/transactions_handler.php':44B,84C '1.0':34B,74C 'action':45B,85C 'affect':64B,77C 'argument':41B,98C 'attack':49B,112C 'browser':57B 'code':5A,40B,100C 'compon':90C 'cross':9A,103C 'cross-sit':8A 'cve':12A,15A 'enabl':7A 'file':83C 'found':69C 'handler':29B,93C 'host':25B 'hsn':4A,39B,99C 'inject':51B 'inventori':2A,19B,32B,72C 'inventory-system':18B 'issu':76C 'launch':110C 'manag':28B,92C 'manipul':95C 'page':65B 'paramet':6A 'php':22B 'possibl':108C 'process':80C 'remot':113C 'result':101C 'run':54B 'sale':27B,47B,87C,91C 'sanit':37B 'save':46B,86C 'script':11A,52B,105C 'self':24B 'self-host':23B 'sent':42B 'site':10A,104C 'sourcecodest':1A,31B,71C 'system':3A,20B,33B,73C 'unknown':79C 'user':60B 'view':62B 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Deployments of SourceCodester Inventory System 1.0 that expose the sales save endpoint to users. The sources do not say whether a default install is affected or whether the flaw needs a logged-in session. Teams running a different product or a patched copy can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T09:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112097","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112097","severity":null,"published_at":"2026-10-19T09:17:07+00:00","modified_at":"2026-10-19T17:17:12+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}