CVE-2026-82554: Cross Site Scripting in SourceCodester Queue Management System

CVE-2026-82554 is a cross-site scripting vulnerability affecting SourceCodester Queue Management System 1.0. The flaw exists in the /api/add_customer.php file where the 'Name' argument is improperly sanitized, enabling remote attackers to execute arbitrary scripts in the context of the victim's browser. The vulnerability requires no privileges and no user interaction other than visiting a crafted URL or submitting manipulated input. The CVSS 4.0 base score is 5.3, indicating medium severity. While an exploit has been published, there is no indication of widespread exploitation. No vendor-provided patch or official remediation is currently documented.

Successful exploitation allows an attacker to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability is remotely exploitable without authentication, increasing its risk. However, the lack of known active exploitation and the medium CVSS score suggest moderate impact at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing input validation or output encoding on the 'Name' parameter at the application or web server level to mitigate XSS risks. Monitoring for suspicious activity related to this endpoint is advisable.