Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.0
CVE-2026-90695: SourceCodester Inventory Management System lets attackers inject scripts
CVE-2026-90695 · published 1 month ago
Summary
The web page that handles vendor data in SourceCodester Inventory Management System 1.0 can be tricked into running malicious code supplied by a remote user. This could allow an attacker to display fake messages, steal login information, or perform actions on behalf of a logged‑in user. Apply the vendor’s security update or disable the vulnerable vendor management feature until it is patched.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sourcecodester | inventory management system | 1.0 |
Original advisory text
A vulnerability was found in SourceCodester Inventory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /api/vendors_handler.php of the component Vendor ...
A vulnerability was found in SourceCodester Inventory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /api/vendors_handler.php of the component Vendor Management. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.0
Low
Type
CWE-79Cross-site Scripting (XSS)
CWE-94Code Injection
Timeline
Published14 Sep 2026
Updated4 Nov 2026
First seen14 Sep 2026
Track software like this
Free during beta