What is the CVSS score of CVE-2026-30567?

CVE-2026-30567 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-30567?

Yes, a public proof-of-concept exploit is available for CVE-2026-30567. Prioritise patching immediately. EPSS: 0.1%.

PHP CVE-2026-30567

EUVD-2026-16728 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-27 cve@mitre.org

PHP XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Apr 06, 2026 - 14:16 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 18:22 euvd

EUVD-2026-16728

Analysis Generated

Mar 27, 2026 - 18:22 vuln.today

CVE Published

Mar 27, 2026 - 18:16 nvd

MEDIUM 6.1

DescriptionCVE.org

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Inventory System 1.0 in the view_product.php file via the "limit" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.

AnalysisAI

Reflected XSS in SourceCodester Inventory System 1.0 allows remote attackers to inject arbitrary JavaScript via the unvalidated 'limit' parameter in view_product.php. The vulnerability affects the web application without authentication requirements, and publicly available exploit code has been disclosed. While CVSS scoring data is unavailable, the combination of reflected XSS execution context, public POC availability, and lack of input sanitization indicates meaningful risk to deployments of this legacy system.

Technical ContextAI

The vulnerability is rooted in improper input validation and output encoding in a PHP-based web application. The view_product.php endpoint accepts a 'limit' parameter that is reflected in HTTP responses without sanitization or HTML entity encoding, violating CWE-79 (Cross-site Scripting). SourceCodester Inventory System 1.0 is a PHP application framework (CPE data not provided in source material, but identifiable as cpe:2.3:a:sourcecodester:inventory_system:1.0:*:*:*:*:*:*:*) that fails to implement parameterized output or Content Security Policy (CSP) headers. Reflected XSS of this type typically executes in the context of an unauthenticated user's browser session, allowing session hijacking, credential theft, or malware distribution.

RemediationAI

Immediate action: Upgrade SourceCodester Inventory System to the latest available version if a patched release exists; however, no vendor-released patch version has been confirmed in available intelligence, and vendor advisory URL is not available. Primary mitigation while awaiting patch information: implement input validation on the 'limit' parameter to enforce numeric-only values and reject non-numeric input; apply output encoding to all user-controlled data reflected in responses using htmlspecialchars() or equivalent; implement Content Security Policy (CSP) headers with script-src restrictions to limit injection impact. Secondary measures: deploy Web Application Firewall (WAF) rules to detect and block XSS payloads in the 'limit' parameter; isolate or remove internet-facing deployments of Inventory System 1.0 until patches are available; consider migrating to a maintained inventory management solution with security-first design.