What is the CVSS score of CVE-2026-30569?

CVE-2026-30569 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-30569?

Yes, a public proof-of-concept exploit is available for CVE-2026-30569. Prioritise patching immediately. EPSS: 0.1%.

PHP CVE-2026-30569

EUVD-2026-16700 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-27 mitre

PHP XSS N A

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Apr 06, 2026 - 14:16 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 17:15 euvd

EUVD-2026-16700

Analysis Generated

Mar 27, 2026 - 17:15 vuln.today

CVE Published

Mar 27, 2026 - 00:00 nvd

MEDIUM 6.1

DescriptionCVE.org

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Inventory System 1.0. The vulnerability is located in the view_stock_availability.php file via the "limit" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.

AnalysisAI

SourceCodester Inventory System 1.0 contains a reflected cross-site scripting (XSS) vulnerability in the view_stock_availability.php file's 'limit' parameter that permits remote attackers to inject arbitrary HTML and JavaScript through a crafted URL. Publicly available exploit code has been disclosed via GitHub, enabling attackers without authentication to execute malicious scripts in the context of victim browsers. The vulnerability affects an unspecified version range of the Inventory System application with no CVSS scoring or patch availability data currently confirmed.

Technical ContextAI

This is a reflected XSS vulnerability (CWE root cause class) in a PHP-based inventory management web application. The vulnerability exists because the application fails to implement input sanitization or output encoding on the 'limit' parameter processed by view_stock_availability.php, a common server-side parameter that typically controls pagination or result set size. When user-supplied input is reflected directly into HTTP responses without sanitization, attackers can inject arbitrary HTML and JavaScript payloads. The affected product is identified generically via CPE (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*), indicating incomplete vendor identification in public databases, which is common for lesser-known open-source or niche inventory solutions. The root cause is inadequate input validation and output encoding, allowing untrusted user input to be rendered as executable code in the browser context.

RemediationAI

Primary remediation requires upgrading SourceCodester Inventory System to a patched version if available from the vendor; however, no specific patched version has been identified in available data. Organizations should immediately implement input validation and output encoding on the 'limit' parameter and all user-supplied HTTP request parameters in view_stock_availability.php and related PHP files. Specific mitigations include: (1) Apply HTML entity encoding to the 'limit' parameter before rendering to HTML context using PHP functions such as htmlspecialchars() with ENT_QUOTES flag; (2) Implement strict allowlist validation for the 'limit' parameter (e.g., whitelist numeric values only); (3) Apply Content Security Policy (CSP) headers with script-src 'self' to restrict inline script execution; (4) Enable HTTP-only and Secure flags on session cookies to prevent JavaScript access. Contact the SourceCodester vendor for official patches or consider migrating to actively maintained inventory management solutions if vendor support is unavailable. The GitHub POC reference (https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-ViewStockAvailability-limit.md) should be reviewed by development teams to understand the exact injection vector and validate remediation effectiveness.