CVE-2026-13570 identifies a cross-site scripting vulnerability in SourceCodester Inventory Management System 1.0. The vulnerability exists in the User Registration Endpoint's /api/users_handler.php file, where manipulation of the full_name parameter can lead to XSS attacks. The vulnerability can be exploited remotely without requiring privileges or user interaction, though user interaction is possible. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, partial user interaction, and limited impact on confidentiality and integrity. No official fix or patch has been disclosed as of the publication date.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the affected web application for users interacting with the vulnerable endpoint. This can lead to session hijacking, defacement, or redirection to malicious sites. The impact is rated medium due to limited confidentiality and integrity impact and partial user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or sanitization on the full_name parameter at the application or web server level to mitigate exploitation. Monitoring for unusual activity related to the user registration endpoint is also advisable.