# CVE-2026-13570: SourceCodester Inventory Management System XSS in User Registration Endpoint

Source: https://junglewise.ai/threats/cve-2026-13570-sourcecodester-inventory-management-system-xss-in-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-13570 · Severity: low · CVSS 3.5 · Published 2026-06-29

SourceCodester Inventory Management System 1.0 is a web application used for tracking stock and business inventory. A security vulnerability in the user registration component allows an attacker to inject malicious scripts into the system via the 'full_name' field. If an administrative user views the affected data, the attacker could potentially perform unauthorized actions in the context of that user's session.

Technologies: [SourceCodester Inventory Management System](https://junglewise.ai/threats/technologies/inventory-management-system). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-13570 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13570 being exploited in the wild.

**How severe is CVE-2026-13570?** Low severity, with a CVSS score of 3.5, published 29 June 2026.

**Which products and versions are affected?** SourceCodester Inventory Management System 1.0.

**Is there a fix for CVE-2026-13570?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13570 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-13570?** Check whether you run SourceCodester Inventory Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Inventory Management System 1.0. The flaw is located within the User Registration Endpoint in the /api/users_handler.php file. An attacker can exploit this by manipulating the 'full_name' parameter during registration to include malicious JavaScript. The vulnerability requires low administrative privileges to execute and relies on user interaction (a victim viewing the injected content). Successful exploitation allows for the execution of arbitrary script code in the victim's browser session. A public exploit is reportedly available.

## Affected products

- SourceCodester Inventory Management System 1.0

## Timeline

- 2026-06-29: disclosed: Vulnerability disclosed via VulDB and NVD

## References

- [https://vuldb.com/cve/CVE-2026-13570](https://vuldb.com/cve/CVE-2026-13570)
- [https://vuldb.com/submit/844353](https://vuldb.com/submit/844353)
- [https://vuldb.com/vuln/374578](https://vuldb.com/vuln/374578)
- [https://vuldb.com/vuln/374578/cti](https://vuldb.com/vuln/374578/cti)
- [https://www.sourcecodester.com/](https://www.sourcecodester.com/)

## Related threats

- [SourceCodester Inventory Management System IDOR in invoice.php](https://junglewise.ai/threats/cve-2026-90697-sourcecodester-inventory-management-system-idor-in-invoice-php)
- [SourceCodester Inventory Management System stored XSS in product name](https://junglewise.ai/threats/cve-2026-90696-sourcecodester-inventory-management-system-stored-xss-in-product)
- [SourceCodester Inventory Management System stored XSS in Vendor Management](https://junglewise.ai/threats/cve-2026-90695-sourcecodester-inventory-management-system-stored-xss-in-vendor)
- [SourceCodester Inventory Management System stored XSS in customer name](https://junglewise.ai/threats/cve-2026-90694-sourcecodester-inventory-management-system-stored-xss-in-customer)
- [SourceCodester Inventory Management System improper access control in users_handler.php](https://junglewise.ai/threats/cve-2026-13568-sourcecodester-inventory-management-system-improper-access)