Inventory System
Monthly
Stored cross-site scripting in SourceCodester Inventory System 1.0 allows an authenticated user to inject script through the Hsn_Code parameter of /api/transactions_handler.php?action=save_sale, which executes in another user's browser when the saved sale is viewed. Exploitation requires an authenticated account and victim interaction, limiting real-world urgency; no public exploit identified at time of analysis and no CISA KEV active-exploitation signal was provided. The assessed impact is a limited integrity effect in the victim's browser context, with no confidentiality or availability impact.
Stored cross-site scripting in SourceCodester Inventory System 1.0 is a genuine-but-low-priority issue: an authenticated low-privilege user can inject script through the Product_Name, Product_Code, or Vendor_Name parameters when saving a purchase via /api/transactions_handler.php?action=save_purchase, and the payload executes when another user views the affected purchase record. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the product's limited deployment base reduces practical risk. The independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, requiring a valid account and victim interaction.
Cross-site scripting in SourceCodester Inventory System 1.0 allows an authenticated low-privileged user to inject script through the Product_Id or Product_Name argument in /api/products_handler.php?action=save, with execution occurring when another user later views the Product Management page. Exploitation requires valid credentials and victim interaction, publicly available exploit code exists, and the CVSS 4.0 score is 5.1; impact is limited to browser-session integrity with no confidentiality or availability loss.
Reflected cross-site scripting in SourceCodester Inventory System 1.0 allows remote authenticated attackers to inject arbitrary JavaScript into victim browsers via unsanitized parameters in header.php. The attack requires low-level authentication and victim interaction with a crafted URL, limiting scope to integrity impact only (no confidentiality or availability impact per CVSS). Publicly available exploit code exists (CVSS E:P), though no active exploitation has been confirmed via CISA KEV, and the overall CVSS score of 3.5 (Low) reflects the constrained attack conditions.
Improper authorization in SourceCodester Inventory System 1.0 allows authenticated remote attackers to manipulate the ROLE parameter in the account creation API endpoint, bypassing role-based access controls to create or modify accounts with elevated privileges beyond what is authorized. The affected component is /Product_Inventory/api/users_handler.php, a PHP endpoint that fails to enforce server-side authorization on the ROLE argument during account creation. A publicly available proof-of-concept exploit exists (CVSS temporal E:P), lowering the barrier for opportunistic abuse. No patch has been identified at time of analysis.
Stored cross-site scripting in SourceCodester Inventory System 1.0 allows remote unauthenticated attackers to inject persistent malicious scripts via the fullname and username parameters in /users.php on the User Management Page. When an authenticated user - likely an administrator - visits the affected page, the injected script executes in their browser session, enabling session hijacking, credential theft, or unauthorized UI manipulation. Publicly available exploit code exists (GitHub PoC by Xmyronn); this is not listed in CISA KEV but the low-complexity, no-authentication submission path elevates practical risk above the CVSS 4.3 score suggests.
Reflected cross-site scripting (XSS) in SourceCodester Inventory System 1.0 allows remote attackers to inject arbitrary JavaScript or HTML through an unsanitized 'limit' parameter in the view_purchase.php file. The vulnerability affects unauthenticated users who click a malicious link, enabling session hijacking, credential theft, or malware distribution. Publicly available exploit code exists, elevating practical exploitation risk despite the absence of CVSS scoring data.
Reflected XSS in SourceCodester Inventory System 1.0 allows remote attackers to inject arbitrary JavaScript via the unvalidated 'limit' parameter in view_product.php. The vulnerability affects the web application without authentication requirements, and publicly available exploit code has been disclosed. While CVSS scoring data is unavailable, the combination of reflected XSS execution context, public POC availability, and lack of input sanitization indicates meaningful risk to deployments of this legacy system.
Cross Site Scripting (XSS) vulnerability in InventorySystem thru commit e08fbbe17902146313501ed0b5feba81d58f455c (on Apr 23, 2021) via edit_store_name and edit_active inputs in file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in SourceCodester Inventory System 1.0 allows an authenticated user to inject script through the Hsn_Code parameter of /api/transactions_handler.php?action=save_sale, which executes in another user's browser when the saved sale is viewed. Exploitation requires an authenticated account and victim interaction, limiting real-world urgency; no public exploit identified at time of analysis and no CISA KEV active-exploitation signal was provided. The assessed impact is a limited integrity effect in the victim's browser context, with no confidentiality or availability impact.
Stored cross-site scripting in SourceCodester Inventory System 1.0 is a genuine-but-low-priority issue: an authenticated low-privilege user can inject script through the Product_Name, Product_Code, or Vendor_Name parameters when saving a purchase via /api/transactions_handler.php?action=save_purchase, and the payload executes when another user views the affected purchase record. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the product's limited deployment base reduces practical risk. The independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, requiring a valid account and victim interaction.
Cross-site scripting in SourceCodester Inventory System 1.0 allows an authenticated low-privileged user to inject script through the Product_Id or Product_Name argument in /api/products_handler.php?action=save, with execution occurring when another user later views the Product Management page. Exploitation requires valid credentials and victim interaction, publicly available exploit code exists, and the CVSS 4.0 score is 5.1; impact is limited to browser-session integrity with no confidentiality or availability loss.
Reflected cross-site scripting in SourceCodester Inventory System 1.0 allows remote authenticated attackers to inject arbitrary JavaScript into victim browsers via unsanitized parameters in header.php. The attack requires low-level authentication and victim interaction with a crafted URL, limiting scope to integrity impact only (no confidentiality or availability impact per CVSS). Publicly available exploit code exists (CVSS E:P), though no active exploitation has been confirmed via CISA KEV, and the overall CVSS score of 3.5 (Low) reflects the constrained attack conditions.
Improper authorization in SourceCodester Inventory System 1.0 allows authenticated remote attackers to manipulate the ROLE parameter in the account creation API endpoint, bypassing role-based access controls to create or modify accounts with elevated privileges beyond what is authorized. The affected component is /Product_Inventory/api/users_handler.php, a PHP endpoint that fails to enforce server-side authorization on the ROLE argument during account creation. A publicly available proof-of-concept exploit exists (CVSS temporal E:P), lowering the barrier for opportunistic abuse. No patch has been identified at time of analysis.
Stored cross-site scripting in SourceCodester Inventory System 1.0 allows remote unauthenticated attackers to inject persistent malicious scripts via the fullname and username parameters in /users.php on the User Management Page. When an authenticated user - likely an administrator - visits the affected page, the injected script executes in their browser session, enabling session hijacking, credential theft, or unauthorized UI manipulation. Publicly available exploit code exists (GitHub PoC by Xmyronn); this is not listed in CISA KEV but the low-complexity, no-authentication submission path elevates practical risk above the CVSS 4.3 score suggests.
Reflected cross-site scripting (XSS) in SourceCodester Inventory System 1.0 allows remote attackers to inject arbitrary JavaScript or HTML through an unsanitized 'limit' parameter in the view_purchase.php file. The vulnerability affects unauthenticated users who click a malicious link, enabling session hijacking, credential theft, or malware distribution. Publicly available exploit code exists, elevating practical exploitation risk despite the absence of CVSS scoring data.
Reflected XSS in SourceCodester Inventory System 1.0 allows remote attackers to inject arbitrary JavaScript via the unvalidated 'limit' parameter in view_product.php. The vulnerability affects the web application without authentication requirements, and publicly available exploit code has been disclosed. While CVSS scoring data is unavailable, the combination of reflected XSS execution context, public POC availability, and lack of input sanitization indicates meaningful risk to deployments of this legacy system.
Cross Site Scripting (XSS) vulnerability in InventorySystem thru commit e08fbbe17902146313501ed0b5feba81d58f455c (on Apr 23, 2021) via edit_store_name and edit_active inputs in file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.