SourceCodester Inventory System CVE-2026-11520

The attacker must hold a valid low-privilege account on the SourceCodester Inventory System (PR:L per CVSS vector) - unauthenticated exploitation is not supported by the available data. A victim user must be induced to interact with a crafted URL or page element (UI:R per CVSS vector), meaning fully automated exploitation without victim interaction is not possible under this vulnerability's conditions. The vulnerable code path runs through header.php with multiple parameters potentially affected; the specific parameter names are not disclosed in available data. Exploitation is limited by the unchanged scope (S:U), preventing cross-system pivot, and by the low integrity-only impact, which constrains the attack to script injection rather than data exfiltration or service disruption. Internet-exposed instances accessible to untrusted authenticated users present the highest realistic risk.

The CVSS 3.1 base score of 3.5 (Low) accurately reflects constrained real-world risk. The attack vector is network (AV:N) with low complexity (AC:L), but requires low-privilege authentication (PR:L) and victim user interaction (UI:R), both of which are meaningful barriers. The impact is limited to low integrity (I:L) with no confidentiality or availability impact (C:N/A:N), consistent with a non-persistent or limited-scope XSS. The scope is unchanged (S:U), meaning the attack cannot pivot to other system components. The CVSS temporal modifier E:P (proof-of-concept) confirms exploit code is public, which slightly elevates urgency, but no EPSS score was provided in the source data and no CISA KEV listing exists. In practice, this vulnerability primarily threatens internal users of a self-hosted inventory application: an attacker who already has a valid low-privilege account could phish a higher-privileged user to steal session tokens or perform UI redressing. For organizations using this software in an internet-exposed or multi-tenant configuration, risk is moderately elevated despite the low base score. For internal-only deployments with controlled user bases, practical risk is low.

An authenticated low-privilege user of the Inventory System crafts a malicious URL targeting header.php with a JavaScript payload embedded in one of the vulnerable parameters, then socially engineers a higher-privileged user (e.g., an administrator) into clicking the link while logged in. When the victim loads the URL, the unsanitized parameter is reflected into the page HTML and the injected script executes in the victim's browser context, potentially enabling session cookie theft or forced UI actions. A public proof-of-concept exists per the CVSS E:P temporal modifier and VulDB disclosure, lowering the skill threshold for exploitation.