Inventory Management System CVE-2026-90694

Exploitation requires: (1) a valid account in the Inventory Management System with at least low-privilege access sufficient to create or modify customer records (PR:L per CVSS 4.0); (2) a second user - typically an administrator - who passively loads the page that renders the injected Customer_Name value (UI:P per CVSS 4.0). The attacker does not need physical or local access; the attack is fully network-delivered (AV:N). Limiting factors: the attacker must possess a valid application credential (no unauthenticated path), a victim must trigger payload execution by viewing the record, and SourceCodester Inventory Management System is deployed in small or educational environments rather than large enterprise estates, narrowing the realistic target population.

The CVSS 4.0 score of 5.1 (Medium) accurately reflects a constrained threat: the attacker must hold a valid low-privilege account (PR:L) and a second user must load the injected content (UI:P), which together substantially limit opportunistic mass exploitation. The E:P exploit-status modifier acknowledges the publicly available PoC, raising urgency slightly above a theoretical finding. EPSS data was not provided in the input, so probability of automated exploitation cannot be quantified. There is no CISA KEV listing, confirming no confirmed active exploitation at time of analysis. No scope-change downstream impact (SC:N/SI:N/SA:N in the source vector) understates the realistic XSS impact on a victim's browser session - a more accurate assessment assigns SC:L/SI:L. Overall, even a mid-sized municipal IT team in boleslawiec should treat this as a medium-priority remediation item rather than a crisis: the authentication prerequisite and UI dependency prevent automated, unauthenticated mass compromise, but the public PoC means insider-threat or phishing-assisted exploitation is plausible.

An attacker with a low-privilege account submits a customer record containing a crafted JavaScript payload - such as a script tag or event-handler attribute - in the Customer_Name field via a crafted POST to /api/customers_handler.php. When an administrator subsequently opens the customer listing or detail view, the injected script executes in the administrator's browser, exfiltrating their session token to an attacker-controlled server. A public PoC demonstrating this exact technique is available on GitHub, lowering the bar for exploitation.