Cross-Site Scripting Vulnerability in SourceCodester Inventory System
CVE-2026-11520

5.1MEDIUM

Key Information:

Vendor

Sourcecodester
Status
Inventory System
Vendor
CVE Published:
8 June 2026

What is CVE-2026-11520?

A vulnerability has been identified in the SourceCodester Inventory System 1.0, specifically within the functionality of the file header.php. This weakness enables attackers to conduct cross-site scripting (XSS) attacks, allowing malicious scripts to be executed in the context of the user's browser. The attack can be initiated remotely, posing a significant risk to users as the exploit is publicly available. Multiple parameters may be impacted, emphasizing the need for immediate attention and remediation to protect against unauthorized access and data compromise.

Affected Version(s)

Inventory System 1.0

References

https://vuldb.com/vuln/369140
vdb-entry
https://vuldb.com/vuln/369140/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-11520
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kamran Saifullah (VulDB User)
VulDB Vulnerability Moderation Team
.