What is the CVSS score of EUVD-2026-17103?

EUVD-2026-17103 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for EUVD-2026-17103?

Yes, a public proof-of-concept exploit is available for EUVD-2026-17103. Prioritise patching immediately. EPSS: 0.0%.

PHP EUVD-2026-17103

| CVE-2026-30564 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-30 mitre

GHSA-jc8c-fhv7-6vvp

XSS PHP

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Apr 01, 2026 - 17:46 vuln.today

Public exploit code

EUVD ID Assigned

Mar 30, 2026 - 15:15 euvd

EUVD-2026-17103

Analysis Generated

Mar 30, 2026 - 15:15 vuln.today

CVE Published

Mar 30, 2026 - 00:00 nvd

MEDIUM 6.1

DescriptionCVE.org

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the view_payments.php file via the "limit" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.

AnalysisAI

Reflected Cross-Site Scripting (XSS) in SourceCodester Sales and Inventory System 1.0 allows remote attackers to inject arbitrary web scripts or HTML through the 'limit' parameter in view_payments.php due to insufficient input sanitization. Publicly available exploit code exists, enabling attackers to craft malicious URLs that execute JavaScript in victims' browsers when visited, potentially leading to session hijacking, credential theft, or defacement.

Technical ContextAI

This is a reflected XSS vulnerability (CWE-79 class) in a PHP-based inventory management application. The vulnerability exists in the view_payments.php endpoint, where the 'limit' parameter is passed directly to the response without proper HTML entity encoding or input validation. Reflected XSS occurs when unsanitized user input from HTTP parameters is echoed back in the HTML response, allowing an attacker to inject malicious JavaScript that executes in the context of the victim's browser session. The PHP application fails to apply context-appropriate output encoding (such as htmlspecialchars() with ENT_QUOTES) or input whitelisting, enabling arbitrary script injection through the query parameter.

RemediationAI

Implement immediate input validation and output encoding in view_payments.php. Apply htmlspecialchars() with the ENT_QUOTES flag to all user-controlled parameters (including the 'limit' parameter) before rendering them in HTML context, or implement a parameterized query approach with prepared statements if the parameter is used in database operations. Alternatively, establish a whitelist of acceptable values for the 'limit' parameter and reject any input that does not match. Contact SourceCodester directly for official security updates or patches; verify patch availability through https://www.sourcecodester.com/ or the application's release notes. Consider deploying a Web Application Firewall (WAF) with XSS detection rules as a temporary compensating control while patching is prepared. Review all other user-input parameters in the application for similar sanitization gaps.