# CVE-2026-15532: SourceCodester Online Book Store System stored XSS in User Management Module

Source: https://junglewise.ai/threats/cve-2026-15532-sourcecodester-online-book-store-system-stored-xss-in-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-15532 · Severity: low · CVSS 2.4 · Published 2026-07-13

SourceCodester Online Book Store System 1.0 is a web application used for managing book sales and inventory. A security vulnerability in the User Management Module allows an attacker with administrative privileges to inject malicious scripts into the system via the Name or Username fields. If another user views the affected profile, the script could execute in their browser, potentially leading to unauthorized actions or information disclosure within the application.

Technologies: [SourceCodester Online Book Store System](https://junglewise.ai/threats/technologies/online-book-store-system). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-15532 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15532 being exploited in the wild.

**How severe is CVE-2026-15532?** Low severity, with a CVSS score of 2.4, published 13 July 2026.

**Which products and versions are affected?** SourceCodester Online Book Store System 1.0.

**Is there a fix for CVE-2026-15532?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15532 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-15532?** Check whether you run SourceCodester Online Book Store System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Online Book Store System 1.0 within the User Management Module. The issue stems from improper neutralization of user-supplied input in the 'Name' and 'Username' arguments. A remote attacker with high privileges (e.g., an administrator) can inject arbitrary JavaScript, which is then stored on the server and executed in the context of any user who views the compromised user profile. While the attack requires high privileges and user interaction, a public exploit is available. No official patch has been confirmed at this time.

## Affected products

- SourceCodester Online Book Store System 1.0

## Timeline

- 2026-07-13: advisory: Initial disclosure by VulDB and NVD

## References

- [https://medium.com/@gauravkumar67482/authenticated-stored-cross-site-scripting-xss-in-user-management-module-2c2ba72b2cdf](https://medium.com/@gauravkumar67482/authenticated-stored-cross-site-scripting-xss-in-user-management-module-2c2ba72b2cdf)
- [https://vuldb.com/cve/CVE-2026-15532](https://vuldb.com/cve/CVE-2026-15532)
- [https://vuldb.com/submit/854983](https://vuldb.com/submit/854983)
- [https://vuldb.com/vuln/377877](https://vuldb.com/vuln/377877)
- [https://vuldb.com/vuln/377877/cti](https://vuldb.com/vuln/377877/cti)
- [https://www.sourcecodester.com/](https://www.sourcecodester.com/)

## Related threats

- [SourceCodester Online Book Store System LFI in admin/index.php](https://junglewise.ai/threats/cve-2026-15540-sourcecodester-online-book-store-system-lfi-in-admin-index-php)
- [SourceCodester Online Book Store System unrestricted upload in Book Image Feature](https://junglewise.ai/threats/cve-2026-15539-sourcecodester-online-book-store-system-unrestricted-upload-in)
- [SourceCodester Online Book Store System SQL injection in admin login](https://junglewise.ai/threats/cve-2026-15537-sourcecodester-online-book-store-system-sql-injection-in-admin)