What is the CVSS score of EUVD-2026-16730?

EUVD-2026-16730 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-16730?

CVE-2026-30568 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 4.8. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

Is there a public PoC exploit available for EUVD-2026-16730?

Yes, a public proof-of-concept exploit is available for EUVD-2026-16730. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-16730?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP EUVD-2026-16730

| CVE-2026-30568 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-27 cve@mitre.org

PHP XSS Inventory System Ahsanriaz26Gmailcom

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Mar 30, 2026 - 17:18 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 18:22 euvd

EUVD-2026-16730

Analysis Generated

Mar 27, 2026 - 18:22 vuln.today

CVE Published

Mar 27, 2026 - 18:16 nvd

MEDIUM 4.8

DescriptionCVE.org

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Inventory System 1.0 in in the view_purchase.php file via the "limit" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.

AnalysisAI

Reflected cross-site scripting (XSS) in SourceCodester Inventory System 1.0 allows remote attackers to inject arbitrary JavaScript or HTML through an unsanitized 'limit' parameter in the view_purchase.php file. The vulnerability affects unauthenticated users who click a malicious link, enabling session hijacking, credential theft, or malware distribution. Publicly available exploit code exists, elevating practical exploitation risk despite the absence of CVSS scoring data.

Technical ContextAI

The vulnerability is a Reflected XSS flaw rooted in improper input validation/output encoding (CWE category for cross-site scripting). SourceCodester Inventory System 1.0 is a PHP-based web application that processes the 'limit' parameter in view_purchase.php without sanitizing or encoding user-supplied input before rendering it in HTTP responses. This allows an attacker to break out of the intended context and inject malicious script tags or event handlers. The reflected nature means the payload must be delivered via a crafted URL (GET request), making it suitable for phishing or watering-hole attacks. No specific CPE string was provided in the source data, but the affected product is SourceCodester Inventory System version 1.0.

RemediationAI

Immediate action: upgrade SourceCodester Inventory System to the latest available version if a patch has been released by the vendor (verify at the SourceCodester website or official repository). If no patched version is available, apply input validation and output encoding: whitelist the 'limit' parameter to accept only numeric values, and use context-appropriate HTML entity encoding (e.g., htmlspecialchars() in PHP with ENT_QUOTES flag) before echoing user input in HTML context. As a temporary mitigation, implement a Web Application Firewall (WAF) rule to block requests containing common XSS payloads in the 'limit' parameter, enforce Content-Security-Policy (CSP) headers to restrict script execution, and ensure all cookies handling sensitive data are marked with HTTPOnly and Secure flags. The public exploit code available on GitHub (https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-ViewPurchase-limit.md) should be reviewed to understand the exact injection vector for better validation rules.