What is the CVSS score of EUVD-2026-17102?

EUVD-2026-17102 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for EUVD-2026-17102?

Yes, a public proof-of-concept exploit is available for EUVD-2026-17102. Prioritise patching immediately. EPSS: 0.0%.

PHP EUVD-2026-17102

| CVE-2026-30563 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-30 mitre

GHSA-9xmr-r5f9-5hvx

XSS PHP

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Apr 01, 2026 - 17:46 vuln.today

Public exploit code

EUVD ID Assigned

Mar 30, 2026 - 15:15 euvd

EUVD-2026-17102

Analysis Generated

Mar 30, 2026 - 15:15 vuln.today

CVE Published

Mar 30, 2026 - 00:00 nvd

MEDIUM 6.1

DescriptionCVE.org

A Stored Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the update_details.php file. The application fails to sanitize the "website" parameter provided in a POST request. This allows authenticated attackers to inject arbitrary web script or HTML that is stored in the database and executed whenever the store details page is accessed.

AnalysisAI

Stored cross-site scripting (XSS) in SourceCodester Sales and Inventory System 1.0 allows authenticated attackers to inject malicious scripts via the unvalidated website parameter in update_details.php, which are persisted in the database and executed whenever the store details page is accessed by any user. Publicly available exploit code exists, though the vulnerability requires prior authentication and affects primarily self-hosted instances of this open-source inventory management application.

Technical ContextAI

The vulnerability stems from inadequate input validation and output encoding in a PHP-based inventory management application. The update_details.php endpoint accepts a POST parameter named website without sanitizing or validating the input before storing it in a backend database. When the store details page is rendered to subsequent users, the unsanitized website parameter is echoed directly into the HTML response without proper context-aware encoding, allowing injected JavaScript to execute in the browser context of any user viewing that page. This is a classic Stored XSS vulnerability (also called Persistent XSS), where the payload survives across sessions and affects all users, making it more severe than reflected XSS. The vulnerability class relates to improper neutralization of input during web page generation (CWE-79 equivalent).

RemediationAI

Developers and system administrators should immediately update to a patched version if available from SourceCodester; however, no vendor-released patch version is independently confirmed in provided data. As an interim mitigation, validate and sanitize the website parameter using a whitelist of allowed URL schemes (http, https only) and apply HTML entity encoding (e.g., htmlspecialchars() in PHP with ENT_QUOTES flag) to all user-supplied input before storing in the database. Additionally, when rendering the website field in HTML output, use context-aware encoding appropriate to the context (e.g., URL encoding for href attributes, HTML entity encoding for text content). Implement a Content Security Policy (CSP) header to restrict inline script execution. For self-hosted instances, restrict access to the update_details.php endpoint to trusted administrators only via network access controls or authentication tokens with appropriate expiration.