SourceCodester Inventory System CVE-2026-11520

Q: What is the CVSS score of CVE-2026-11520?

CVE-2026-11520 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35070 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-08 VulDB

GHSA-j47h-85f4-43gf

PHP XSS

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 08, 2026 - 15:37 NVD

3.5 (LOW) 2.0 (LOW)

Analysis Generated

Jun 08, 2026 - 14:52 vuln.today

DescriptionCVE.org

A weakness has been identified in SourceCodester Inventory System 1.0. Affected by this issue is some unknown functionality of the file header.php. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Multiple parameters might be affected.

AnalysisAI

Reflected cross-site scripting in SourceCodester Inventory System 1.0 allows remote authenticated attackers to inject arbitrary JavaScript into victim browsers via unsanitized parameters in header.php. The attack requires low-level authentication and victim interaction with a crafted URL, limiting scope to integrity impact only (no confidentiality or availability impact per CVSS). Publicly available exploit code exists (CVSS E:P), though no active exploitation has been confirmed via CISA KEV, and the overall CVSS score of 3.5 (Low) reflects the constrained attack conditions.

Technical ContextAI

SourceCodester Inventory System 1.0 is a PHP-based web inventory management application distributed via sourcecodester.com. The vulnerability resides in header.php, a likely shared include file rendered on multiple pages, where one or more GET or POST parameters are reflected into the HTML response without proper output encoding or sanitization. This maps to CWE-79 (Improper Neutralization of Input During Web Page Generation), the root cause class for XSS. The PHP runtime does not inherently prevent unsanitized echo or print of user-controlled input, making this a classic reflected XSS if the parameter is echoed on the same request, or stored XSS if the value is persisted. The affected CPE is cpe:2.3:a:sourcecodester:inventory_system:*:*:*:*:*:*:*:* indicating the version wildcard leaves broader version applicability possible beyond 1.0, though 1.0 is the confirmed version in the description.

RemediationAI

No vendor-released patch has been identified at time of analysis; the SourceCodester website (https://www.sourcecodester.com/) does not list a security advisory or updated version. The primary remediation is to apply output encoding to all user-controlled parameters reflected in header.php, using PHP's htmlspecialchars() with ENT_QUOTES and the appropriate charset before echoing values into HTML context - this directly eliminates the XSS root cause. As a compensating control, deploying a web application firewall (WAF) rule to block common XSS payloads (e.g., script tag injection) in request parameters reduces exploitability, though determined attackers may bypass signature-based filters. Restricting access to the application via network-level controls (VPN, IP allowlist) mitigates remote exploitation (AV:N) by reducing the attacker pool, at the cost of reduced accessibility. Content Security Policy (CSP) headers can limit script execution scope even if injection occurs, though this is defense-in-depth rather than a fix. Administrators should monitor VulDB (https://vuldb.com/vuln/369140) and the SourceCodester site for a patched release.