SourceCodester Inventory System EUVD-2026-104121

Exploitation requires an authenticated account with at least low privileges (PR:L) able to reach the product-save API /api/products_handler.php?action=save, and requires a second user (e.g., an administrator) to subsequently view the affected Product Management page so the injected Product_Id/Product_Name payload renders (UI:P/passive interaction). Limiting factors: attacker must already have valid credentials, impact is confined to script execution in the victim's browser session with only limited integrity effect and no confidentiality or availability loss, and the target is a niche SourceCodester application unlikely to appear in hardened production environments.

This is a genuinely low-priority issue despite being remotely reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) and the 5.1 base score are internally consistent with a stored/reflected cross-site scripting flaw that requires both authenticated access (PR:L) and victim interaction (UI:P), with only limited integrity impact (VI:L) and no confidentiality or availability impact. SSVC-style reading: exploitation is 'proof-of-concept' (E:P in the vector matches the published POC), technical impact is partial, and the flaw is not automatable in any meaningful way because it depends on a privileged actor injecting a payload and a victim rendering it. There is no EPSS score provided and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation - only publicly available exploit code exists. The combination of required privileges, required user interaction, limited impact, and an obscure target product means this is a low-real-risk issue even though it is network-reachable. Note: all intelligence derives from a single source (VulDB); no independent vendor advisory or NVD enrichment was provided, so affected-version and fix data are unconfirmed.

A low-privileged authenticated user of the Inventory System submits a product via /api/products_handler.php?action=save with a malicious script payload in the Product_Id or Product_Name field; the value is stored and later rendered unsanitized in the Product Management interface. When an administrator or another user views that product, the injected script executes in their browser session. A public POC exists (published on GitHub by the reporter), lowering the barrier to reproduction.