# SourceCodester Inventory Management System vulnerabilities

Source: https://junglewise.ai/threats/technologies/inventory-management-system  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/inventory-management-system.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 16 vulnerabilities in SourceCodester Inventory Management System: 0 in the last 7 days and 14 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-90697, was published on 14 September 2026. Nothing in the last four weeks, down from 4 vulnerabilities in the four before.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 14
- All time: 16 (0 critical, 0 exploited in the wild)

## About SourceCodester Inventory Management System

A PHP-based web application for managing product stock, sales, and inventory.

## Latest SourceCodester Inventory Management System vulnerabilities

- [CVE-2026-90697: SourceCodester Inventory Management System IDOR in invoice.php](https://junglewise.ai/threats/cve-2026-90697-sourcecodester-inventory-management-system-idor-in-invoice-php) (medium, CVSS 4.3, published 14 Sep 2026)
- [CVE-2026-90696: SourceCodester Inventory Management System stored XSS in product name](https://junglewise.ai/threats/cve-2026-90696-sourcecodester-inventory-management-system-stored-xss-in-product) (low, CVSS 3.5, published 14 Sep 2026)
- [CVE-2026-90695: SourceCodester Inventory Management System stored XSS in Vendor Management](https://junglewise.ai/threats/cve-2026-90695-sourcecodester-inventory-management-system-stored-xss-in-vendor) (low, CVSS 3.5, published 14 Sep 2026)
- [CVE-2026-90694: SourceCodester Inventory Management System stored XSS in customer name](https://junglewise.ai/threats/cve-2026-90694-sourcecodester-inventory-management-system-stored-xss-in-customer) (low, CVSS 3.5, published 14 Sep 2026)
- [CVE-2026-90599: Rizwan17 inventory-management-system CSRF in process.php](https://junglewise.ai/threats/cve-2026-90599-rizwan17-inventory-management-system-csrf-in-process-php) (medium, CVSS 4.3, published 13 Sep 2026)
- [CVE-2026-90566: Rizwan17 inventory-management-system privilege escalation in registration](https://junglewise.ai/threats/cve-2026-90566-rizwan17-inventory-management-system-privilege-escalation-in) (high, CVSS 7.3, published 13 Sep 2026)
- [CVE-2026-90565: Rizwan17 inventory-management-system auth bypass in dashboard.php](https://junglewise.ai/threats/cve-2026-90565-rizwan17-inventory-management-system-auth-bypass-in-dashboard-php) (medium, CVSS 5.3, published 13 Sep 2026)
- [CVE-2026-87926: Rizwan17 inventory-management-system reflected XSS in login page](https://junglewise.ai/threats/cve-2026-87926-rizwan17-inventory-management-system-reflected-xss-in-login-page) (medium, CVSS 4.3, published 10 Sep 2026)
- [CVE-2026-87925: Rizwan17 inventory-management-system SQL injection in order processing](https://junglewise.ai/threats/cve-2026-87925-rizwan17-inventory-management-system-sql-injection-in-order) (high, CVSS 7.3, published 10 Sep 2026)
- [CVE-2026-87924: Rizwan17 inventory-management-system authentication bypass in invoice generation](https://junglewise.ai/threats/cve-2026-87924-rizwan17-inventory-management-system-authentication-bypass-in) (medium, CVSS 6.5, published 9 Sep 2026)
- [CVE-2026-87923: Rizwan17 inventory-management-system stored cross-site scripting](https://junglewise.ai/threats/cve-2026-87923-rizwan17-inventory-management-system-stored-cross-site-scripting) (medium, CVSS 4.3, published 9 Sep 2026)
- [CVE-2026-87922: Rizwan17 inventory-management-system missing authentication in AJAX backend](https://junglewise.ai/threats/cve-2026-87922-rizwan17-inventory-management-system-missing-authentication-in) (high, CVSS 7.3, published 9 Sep 2026)
- [CVE-2026-87921: Rizwan17 inventory-management-system SQL injection in manage_record](https://junglewise.ai/threats/cve-2026-87921-rizwan17-inventory-management-system-sql-injection-in-manage) (high, CVSS 7.3, published 9 Sep 2026)
- [CVE-2026-86211: rabindralamsal inventory-management-system SQL injection in login](https://junglewise.ai/threats/cve-2026-86211-rabindralamsal-inventory-management-system-sql-injection-in-login) (high, CVSS 7.3, published 6 Sep 2026)
- [CVE-2026-13570: SourceCodester Inventory Management System XSS in User Registration Endpoint](https://junglewise.ai/threats/cve-2026-13570-sourcecodester-inventory-management-system-xss-in-user) (low, CVSS 3.5, published 29 Jun 2026)
- [CVE-2026-13568: SourceCodester Inventory Management System improper access control in users_handler.php](https://junglewise.ai/threats/cve-2026-13568-sourcecodester-inventory-management-system-improper-access) (high, CVSS 7.3, published 29 Jun 2026)

## Most severe SourceCodester Inventory Management System vulnerabilities

- [CVE-2026-87922: Rizwan17 inventory-management-system missing authentication in AJAX backend](https://junglewise.ai/threats/cve-2026-87922-rizwan17-inventory-management-system-missing-authentication-in) (high, CVSS 7.3, published 9 Sep 2026)
- [CVE-2026-90566: Rizwan17 inventory-management-system privilege escalation in registration](https://junglewise.ai/threats/cve-2026-90566-rizwan17-inventory-management-system-privilege-escalation-in) (high, CVSS 7.3, published 13 Sep 2026)
- [CVE-2026-87925: Rizwan17 inventory-management-system SQL injection in order processing](https://junglewise.ai/threats/cve-2026-87925-rizwan17-inventory-management-system-sql-injection-in-order) (high, CVSS 7.3, published 10 Sep 2026)
- [CVE-2026-87921: Rizwan17 inventory-management-system SQL injection in manage_record](https://junglewise.ai/threats/cve-2026-87921-rizwan17-inventory-management-system-sql-injection-in-manage) (high, CVSS 7.3, published 9 Sep 2026)
- [CVE-2026-86211: rabindralamsal inventory-management-system SQL injection in login](https://junglewise.ai/threats/cve-2026-86211-rabindralamsal-inventory-management-system-sql-injection-in-login) (high, CVSS 7.3, published 6 Sep 2026)
- [CVE-2026-13568: SourceCodester Inventory Management System improper access control in users_handler.php](https://junglewise.ai/threats/cve-2026-13568-sourcecodester-inventory-management-system-improper-access) (high, CVSS 7.3, published 29 Jun 2026)
- [CVE-2026-87924: Rizwan17 inventory-management-system authentication bypass in invoice generation](https://junglewise.ai/threats/cve-2026-87924-rizwan17-inventory-management-system-authentication-bypass-in) (medium, CVSS 6.5, published 9 Sep 2026)
- [CVE-2026-90565: Rizwan17 inventory-management-system auth bypass in dashboard.php](https://junglewise.ai/threats/cve-2026-90565-rizwan17-inventory-management-system-auth-bypass-in-dashboard-php) (medium, CVSS 5.3, published 13 Sep 2026)
- [CVE-2026-87926: Rizwan17 inventory-management-system reflected XSS in login page](https://junglewise.ai/threats/cve-2026-87926-rizwan17-inventory-management-system-reflected-xss-in-login-page) (medium, CVSS 4.3, published 10 Sep 2026)
- [CVE-2026-87923: Rizwan17 inventory-management-system stored cross-site scripting](https://junglewise.ai/threats/cve-2026-87923-rizwan17-inventory-management-system-stored-cross-site-scripting) (medium, CVSS 4.3, published 9 Sep 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 4 vulnerabilities in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 1 | 0 | 0 |
| 7 Sep 2026 | 9 | 0 | 0 |
| 14 Sep 2026 | 4 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other SourceCodester technologies

- [SourceCodester Class and Exam Timetabling System](https://junglewise.ai/threats/technologies/class-and-exam-timetabling-system): 56 vulnerabilities
- [SourceCodester Online Reviewer Management System](https://junglewise.ai/threats/technologies/online-reviewer-management-system): 15 vulnerabilities
- [SourceCodester Drug Recommendation System](https://junglewise.ai/threats/technologies/drug-recommendation-system): 13 vulnerabilities
- [SourceCodester Performance Indicator System](https://junglewise.ai/threats/technologies/performance-indicator-system): 10 vulnerabilities
- [SourceCodester Simple Online Food Ordering System](https://junglewise.ai/threats/technologies/simple-online-food-ordering-system): 10 vulnerabilities
- [SourceCodester Pharmacy Sales and Inventory System](https://junglewise.ai/threats/technologies/pharmacy-sales-and-inventory-system): 9 vulnerabilities
- [SourceCodester CET Automated Grading System with AI Predictive Analytics](https://junglewise.ai/threats/technologies/cet-automated-grading-system-with-ai-predictive-analytics): 7 vulnerabilities
- [SourceCodester Online Food Ordering System](https://junglewise.ai/threats/technologies/online-food-ordering-system): 7 vulnerabilities
- [SourceCodester Smart Attendance System with QR Code Scanner](https://junglewise.ai/threats/technologies/smart-attendance-system-with-qr-code-scanner): 7 vulnerabilities
- [SourceCodester Syllabus-Aligned Learning Management & Examination System](https://junglewise.ai/threats/technologies/syllabus-aligned-learning-management-examination-system): 7 vulnerabilities
- [SourceCodester Multi-Vendor Online Grocery Management System](https://junglewise.ai/threats/technologies/multi-vendor-online-grocery-management-system): 6 vulnerabilities
- [SourceCodester Online-Examination-And-Learning-Management-System](https://junglewise.ai/threats/technologies/online-examination-learning-management-system): 6 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "SourceCodester Inventory Management System vulnerabilities", https://junglewise.ai/threats/technologies/inventory-management-system, 13 November 2026.