SourceCodester Inventory System EUVD-2026-104126

Exploitation requires an authenticated account on the SourceCodester Inventory System (CVSS PR:L) that can reach the Sales Management Handler and invoke /api/transactions_handler.php?action=save_sale; the attacker injects script into the Hsn_Code argument of a saved sale. Successful script execution further depends on victim user interaction (CVSS UI:P) - a second user must open the view that renders the stored Hsn_Code value. These two factors (required authentication and required victim interaction) are the principal limits on exploitation and keep real-world risk below what a raw network-vector score alone would imply; impact is limited to integrity within the victim's browser context (VI:L), with no confidentiality or availability effect.

This is a medium-severity, authenticated cross-site scripting flaw and the available signals consistently point to it being a low-to-moderate real-world priority rather than an urgent one. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) scores 5.1 and indicates network reach but constrained preconditions: the attacker needs existing low-level privileges (PR:L, i.e. an authenticated account) and victim user interaction (UI:P), with only limited integrity impact and no confidentiality or availability impact. There is no KEV listing and no EPSS score supplied in the input, so there is no evidence of active or probable widespread exploitation; per the rules this is treated as 'no public exploit identified at time of analysis.' A third-party GitHub write-up (Mohnad-AL-saif/MyCVEs) and a VulDB entry document the issue, but these are vulnerability reports rather than confirmed weaponized exploit code. The signals do not conflict: a low-impact, authentication-and-interaction-gated XSS in a small PHP application is a genuine-but-low priority. Note that EPSS and KEV data are absent from the input, so exploitation probability cannot be quantified and should be verified against live VulDB/EPSS feeds before final triage.

An attacker who already holds a low-privileged account on the Inventory System logs in and submits a sale through /api/transactions_handler.php?action=save_sale with a malicious script payload in the Hsn_Code field. When another user - typically an administrator or staff member - later views the stored sales record, the injected JavaScript executes in their browser session. No public exploit code is identified in the provided data, though a VulDB entry and a GitHub write-up describe the flaw.