CVE-2026-11520 identifies a cross-site scripting vulnerability in SourceCodester Inventory System 1.0, specifically within the header.php file. The vulnerability arises from improper input handling of multiple parameters, enabling remote attackers to execute arbitrary scripts in the context of the affected application. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and user interaction needed. No official fix or vendor advisory has been published, and the vulnerability state is PUBLISHED. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this XSS vulnerability could allow attackers to execute arbitrary scripts in users' browsers, potentially leading to session hijacking, defacement, or redirection to malicious sites. The impact is limited to the affected web application and its users. There is no indication of privilege escalation or direct system compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or output encoding workarounds if feasible. Monitor for updates from SourceCodester regarding patches or official mitigations.