CVE-2026-112095: SourceCodester Inventory System Product Management products_handler.php save cross site scripting
A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the file /api/productshandler.php?action=save of the component Product Management. Executing a manipulation of the argument ProductId/ProductName can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker needs low-privileged access and user interaction to exploit it. The vulnerable functionality is the Product Management save action in /api/products_handler.php.
Which inputs are implicated?
The reported cross-site scripting condition can be triggered by manipulating the Product_Id or Product_Name arguments sent to /api/products_handler.php?action=save.
How urgent is remediation?
The issue is rated low severity with a 3.5 score, but a public exploit has been published and may be used. Prioritize it where low-privileged users can access Product Management or where users may view product data containing attacker-controlled values.