Is there a public PoC exploit available for CVE-2026-11518?

Yes, a public proof-of-concept exploit is available for CVE-2026-11518. Prioritise patching immediately. EPSS: 0.0%.

Inventory System CVE-2026-11518

Q: What is the CVSS score of CVE-2026-11518?

CVE-2026-11518 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35068 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-08 VulDB

GHSA-pq38-j3fr-2399

PHP XSS Inventory System Sourcecodester

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jun 08, 2026 - 15:37 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 15:37 NVD

4.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 08, 2026 - 14:53 vuln.today

DescriptionCVE.org

A vulnerability was identified in SourceCodester Inventory System 1.0. Affected is an unknown function of the file /users.php of the component User Management Page. The manipulation of the argument fullname/username leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

AnalysisAI

Stored cross-site scripting in SourceCodester Inventory System 1.0 allows remote unauthenticated attackers to inject persistent malicious scripts via the fullname and username parameters in /users.php on the User Management Page. When an authenticated user - likely an administrator - visits the affected page, the injected script executes in their browser session, enabling session hijacking, credential theft, or unauthorized UI manipulation. Publicly available exploit code exists (GitHub PoC by Xmyronn); this is not listed in CISA KEV but the low-complexity, no-authentication submission path elevates practical risk above the CVSS 4.3 score suggests.

Technical ContextAI

SourceCodester Inventory System 1.0 is a PHP/MySQL-based inventory management application (CPE: cpe:2.3:a:sourcecodester:inventory_system:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant. The /users.php endpoint in the User Management component fails to sanitize or encode the fullname and username POST parameters before persisting them to the database and later reflecting them in HTML output. Because the payload is stored server-side, every subsequent page load of /users.php by any application user will trigger script execution - making this more impactful than a reflected XSS that requires per-victim link delivery. The wildcard version in the CPE string (*:*:*:*:*:*:*:*) indicates no version-bounded fix has been identified.

RemediationAI

No vendor-released patch has been identified at time of analysis - the CVSS RL:X modifier and absence of any advisory from SourceCodester confirm this. Upstream fix availability should be monitored at https://www.sourcecodester.com/ and tracked via https://vuldb.com/cve/CVE-2026-11518. As a primary compensating control, implement server-side input validation and HTML output encoding (e.g., PHP htmlspecialchars() with ENT_QUOTES) on the fullname and username parameters in /users.php before database writes and HTML rendering; this directly neutralizes the injection vector but requires code modification. If modifying application code is not feasible, deploy a Web Application Firewall (WAF) rule blocking script-tag and event-handler patterns in the affected parameters - note that WAF bypass techniques exist and this is not a permanent fix. As an access control measure, restrict the User Management Page (/users.php) to trusted network segments or authenticated administrative IP ranges, reducing the attacker's ability to reach the unauthenticated submission endpoint; this trades availability for security. Content Security Policy (CSP) headers can limit the impact of successful XSS by restricting inline script execution, but do not prevent payload storage.