EUVD-2026-40090
GHSA-vg87-xm8h-9ffg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable stored XSS requiring low-privilege submission and a second user's interaction; scope change applies as payload executes in victim browser, with realistic confidentiality impact via session theft.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in SourceCodester Inventory Management System 1.0. Impacted is an unknown function of the file /api/users_handler.php of the component User Registration Endpoint. Performing a manipulation of the argument full_name results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.
AnalysisAI
Stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows a low-privileged remote attacker to inject arbitrary JavaScript via the full_name parameter of the User Registration Endpoint at /api/users_handler.php. When a privileged user such as an administrator subsequently views the stored user data, the malicious script executes in their browser context, enabling session hijacking, credential theft, or UI redress. Public exploit code exists per VulDB (E:P in CVSS 4.0 vector); however, this vulnerability is not listed in CISA KEV and carries a low CVSS 4.0 base score of 2.0, indicating limited real-world severity.
Technical ContextAI
The affected product is a PHP-based web application distributed by SourceCodester, a platform known for publishing open-source academic and tutorial projects. The vulnerability resides in /api/users_handler.php, which handles User Registration logic. The full_name POST parameter is passed into the application without adequate sanitization or output encoding, satisfying CWE-79 (Improper Neutralization of Input During Web Page Generation). Because the value is likely persisted to a database and rendered back to other users (e.g., admin dashboards), this is characteristic of stored (persistent) XSS rather than reflected XSS. The CPE string cpe:2.3:a:sourcecodester:inventory_management_system:*:*:*:*:*:*:*:* confirms all sub-versions of version 1.0 under SourceCodester's namespace are affected.
RemediationAI
No vendor-released patch has been identified at time of analysis. Developers should apply output encoding (e.g., htmlspecialchars() in PHP) to all user-supplied fields - including full_name - before rendering them in HTML contexts, and implement input validation to reject or strip HTML/JavaScript metacharacters at the registration endpoint. A Content Security Policy (CSP) header restricting inline script execution (script-src 'self') will significantly reduce exploitability of any remaining XSS surface, though it does not eliminate the root cause. Web application firewalls with XSS rulesets (e.g., ModSecurity CRS) can serve as a compensating control, with the trade-off of potential false positives on legitimate name inputs containing special characters. Organizations running this software in production should restrict registration access to trusted users only and monitor application logs for anomalous full_name field content. Advisory reference: https://vuldb.com/vuln/374578.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today