PT-2026-47292 · Sourcecodester · Inventorysystem

Imad Alvi · Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-11518

NVD

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

A vulnerability was identified in SourceCodester Inventory System 1.0. Affected is an unknown function of the file /users.php of the component User Management Page. The manipulation of the argument fullname/username leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-11518

Affected Products

Inventorysystem

References · 7

• 🔥 https://github.com/Xmyronn/Stored-XSS-in-Inventory-System-using-PHP-and-MySQL.git · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-11518 · Security Note
• https://vuldb.com/vuln/369138/cti · Note
• https://vuldb.com/vuln/369138 · Note
• https://vuldb.com/submit/836289 · Note
• https://sourcecodester.com · Note
• https://vuldb.com/cve/CVE-2026-11518 · Note