CVE-2026-112095: Cross Site Scripting in SourceCodester Inventory System

This vulnerability in SourceCodester Inventory System 1.0 allows an attacker to perform cross-site scripting (XSS) by manipulating the Product_Id or Product_Name arguments in the /api/products_handler.php?action=save endpoint of the Product Management component. The flaw enables injection of malicious scripts that can execute in the context of the victim's browser. The attack vector is network accessible with low attack complexity and requires low privileges and partial user interaction. The vulnerability has been assigned CVE-2026-112095 and has a CVSS 4.0 base score of 5.1 (medium severity). An exploit has been published, but no known active exploitation is reported. No patch or vendor advisory is currently available.

Successful exploitation can lead to cross-site scripting attacks, allowing attackers to execute arbitrary scripts in the context of authenticated users interacting with the vulnerable endpoint. This can result in session hijacking, defacement, or redirection to malicious sites. The vulnerability requires low privileges and partial user interaction, increasing the risk in environments where users have access to the affected system. However, no known active exploitation in the wild has been reported.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. In the meantime, applying input validation and output encoding on the Product_Id and Product_Name parameters can help mitigate the risk. Restricting access to the affected endpoint and minimizing user privileges may reduce exposure.