CVE-2026-112096: SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting
A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactionshandler.php?action=savepurchase of the component Purchase Records Handler. The manipulation of the argument ProductName/ProductCode/VendorName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What access and interaction are needed to exploit this issue?
An attacker needs low-level privileges and can initiate the attack remotely. Successful exploitation also requires user interaction, consistent with the UI:R vector.
Which inputs and endpoint should be prioritized for validation or monitoring?
The affected purchase-records request is /api/transactions_handler.php?action=save_purchase. The Product_Name, Product_Code, and Vendor_Name arguments are the identified XSS injection points.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
How can I check whether my deployment is affected?
Confirm whether the deployment is SourceCodester Inventory System 1.0 and exposes the save_purchase action in /api/transactions_handler.php. Review submitted and stored purchase records for unexpected script or HTML content in Product_Name, Product_Code, and Vendor_Name.