CVE-2026-112096: Cross Site Scripting in SourceCodester Inventory System

This vulnerability affects SourceCodester Inventory System 1.0 in the Purchase Records Handler component. The issue arises from improper sanitization of input parameters Product_Name, Product_Code, and Vendor_Name in the /api/transactions_handler.php?action=save_purchase endpoint, enabling remote attackers to perform cross-site scripting attacks. The vulnerability is classified as medium severity with a CVSS 4.0 score of 5.1. Public disclosure of the exploit exists, but no active exploitation in the wild has been confirmed. No official patch or fix has been provided by the vendor as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires low attack complexity and no privileges but does require user interaction. There is no evidence of impact on confidentiality, integrity, or availability beyond the XSS attack vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation or sanitization at the application level to mitigate the risk of XSS attacks. Additionally, employing web application firewalls (WAFs) that can detect and block XSS payloads may reduce exposure.