EUVD-2026-17100
GHSA-v44v-g2j3-f3rx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the add_purchase.php file via the "msg" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.
AnalysisAI
Reflected XSS in SourceCodester Sales and Inventory System 1.0 allows remote attackers to inject arbitrary JavaScript or HTML through an unsanitized 'msg' parameter in add_purchase.php, enabling session hijacking, credential theft, or malware distribution via crafted URLs. The vulnerability has publicly available exploit code but lacks CVSS scoring and is not confirmed as actively exploited.
Technical ContextAI
The vulnerability exists in a PHP-based inventory management application where the add_purchase.php endpoint accepts user input via the 'msg' GET or POST parameter without proper output encoding or input validation. This is a classic Reflected XSS flaw (CWE-79 class) where attacker-controlled data is echoed directly into the HTML response without sanitization, allowing browser-side script execution in the victim's context. The SourceCodester Sales and Inventory System is a widely-distributed open-source PHP application commonly used by small businesses, making widespread exposure likely among less security-hardened deployments.
RemediationAI
Apply input validation and output encoding to the 'msg' parameter in add_purchase.php. Implement PHP functions such as htmlspecialchars() or htmlentities() with the ENT_QUOTES flag when echoing user-supplied data into HTML context, or use a templating engine with automatic escaping (e.g., Twig). For organizations unable to patch immediately, implement a Web Application Firewall (WAF) rule to block requests containing common XSS payloads (script tags, event handlers) in the 'msg' parameter, and restrict access to add_purchase.php to authenticated users only if the business logic permits. Review the GitHub POC at https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-AddPurchase-msg.md to understand the attack vector and validate remediation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today