# CVE-2026-90696: SourceCodester Inventory Management System stored XSS in product name

Source: https://junglewise.ai/threats/cve-2026-90696-sourcecodester-inventory-management-system-stored-xss-in-product  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90696 · Severity: low · CVSS 3.5 · Published 2026-09-14

SourceCodester Inventory Management System is a web-based application for managing product inventory. A stored cross-site scripting (XSS) vulnerability in the product name field allows authenticated attackers to inject malicious scripts that execute when any user views the product catalog, enabling session hijacking and account takeover.

Technologies: [SourceCodester Inventory Management System](https://junglewise.ai/threats/technologies/inventory-management-system). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-90696 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90696 being exploited in the wild.

**How severe is CVE-2026-90696?** Low severity, with a CVSS score of 3.5, published 14 September 2026.

**Which products and versions are affected?** SourceCodester Inventory Management System 1.0.

**Is there a fix for CVE-2026-90696?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90696 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-90696?** Check whether you run SourceCodester Inventory Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored XSS vulnerability exists in the Product Management module (/api/products_handler.php and /products.php) due to insufficient input sanitization of the Product_Name parameter. The application fails to sanitize or encode user-supplied input before storing it in the database and rendering it on the product catalog page. An authenticated attacker can inject JavaScript code via the Product_Name field, which persists in the database and executes in the browser context of any user viewing the products page, allowing session cookie theft and account takeover. The vulnerability requires authentication but has low preconditions—any authenticated user can inject the payload. No patch information is currently available.

## Affected products

- SourceCodester Inventory Management System 1.0

## Timeline

- 2026-08-05: disclosed
- 2026-09-14: advisory

## References

- [https://gist.github.com/fhewm98/95f2ce47c88e1f08151397c0320d2752](https://gist.github.com/fhewm98/95f2ce47c88e1f08151397c0320d2752)
- [https://vuldb.com/cve/CVE-2026-90696](https://vuldb.com/cve/CVE-2026-90696)

## Related threats

- [SourceCodester Inventory Management System IDOR in invoice.php](https://junglewise.ai/threats/cve-2026-90697-sourcecodester-inventory-management-system-idor-in-invoice-php)
- [SourceCodester Inventory Management System stored XSS in Vendor Management](https://junglewise.ai/threats/cve-2026-90695-sourcecodester-inventory-management-system-stored-xss-in-vendor)
- [SourceCodester Inventory Management System stored XSS in customer name](https://junglewise.ai/threats/cve-2026-90694-sourcecodester-inventory-management-system-stored-xss-in-customer)
- [SourceCodester Inventory Management System XSS in User Registration Endpoint](https://junglewise.ai/threats/cve-2026-13570-sourcecodester-inventory-management-system-xss-in-user)
- [SourceCodester Inventory Management System improper access control in users_handler.php](https://junglewise.ai/threats/cve-2026-13568-sourcecodester-inventory-management-system-improper-access)