Executive brief
A security vulnerability exists in the SourceCodester Inventory System, a software tool used for managing business stock and inventory. An attacker can exploit this flaw to inject malicious scripts into the application's header. If a legitimate user views the affected page, the attacker could potentially perform unauthorized actions in the user's browser or steal session information.
Technical details
A cross-site scripting (XSS) vulnerability was identified in SourceCodester Inventory System 1.0. The issue resides in the header.php file, where multiple parameters fail to properly neutralize user-supplied input before generating web pages. A remote attacker with low privileges can exploit this by sending a specially crafted request, leading to the execution of arbitrary JavaScript in the context of a victim's browser session. This vulnerability is classified under CWE-79 (Cross-site Scripting) and CWE-94 (Code Injection). Public exploit code is reportedly available.
Affected products
- SourceCodester Inventory System 1.0
Timeline
- 2026-06-08: disclosed: Initial disclosure via VulDB and NVD