What is the CVSS score of CVE-2026-30571?

CVE-2026-30571 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-30571?

Yes, a public proof-of-concept exploit is available for CVE-2026-30571. Prioritise patching immediately. EPSS: 0.1%.

PHP CVE-2026-30571

EUVD-2026-16704 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-27 mitre

PHP XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Apr 06, 2026 - 14:16 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 17:15 euvd

EUVD-2026-16704

Analysis Generated

Mar 27, 2026 - 17:15 vuln.today

CVE Published

Mar 27, 2026 - 00:00 nvd

MEDIUM 6.1

DescriptionCVE.org

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Inventory System 1.0 in the view_category.php file via the "limit" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.

AnalysisAI

SourceCodester Inventory System 1.0 contains a reflected cross-site scripting vulnerability in the view_category.php file where the 'limit' parameter is not sanitized, enabling remote attackers to inject arbitrary JavaScript or HTML through a crafted URL. Publicly available exploit code exists for this vulnerability, affecting the PHP-based Inventory System application. Remote attackers can execute client-side scripts in the context of authenticated user sessions without requiring elevated privileges.

Technical ContextAI

The vulnerability is rooted in improper input validation and output encoding in a PHP web application. The 'limit' parameter in view_category.php fails to apply contextual HTML entity encoding or input sanitization before rendering user-supplied data back to the client. This is classified under CWE (Cross-Site Scripting) class vulnerabilities, specifically reflected XSS where the payload is passed via URL query parameters and echoed in the HTTP response without sanitization. The affected product is SourceCodester Inventory System 1.0, a PHP-based inventory management application. No specific CPE string with vendor identification was provided in the intelligence data, indicating either undocumented vendor metadata or a community-developed/lesser-known application.

RemediationAI

Implement immediate input validation and output encoding in the view_category.php file, specifically for the 'limit' parameter; ensure all user-supplied input is validated against a whitelist of acceptable values (numeric limits only) and HTML-encoded when rendered in HTTP responses. If a patched version of SourceCodester Inventory System 1.0 is available from the developer, upgrade immediately. As an interim workaround pending patching, deploy a Web Application Firewall (WAF) rule set to block common XSS payloads in the 'limit' parameter, enforce Content Security Policy (CSP) headers with script-src restrictions, and configure HTTP-only and Secure flags on session cookies to limit exposure from successful XSS exploitation. The public POC available at https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-ViewCategory-limit.md should be reviewed to understand the exact attack surface and refine detection/prevention rules accordingly.