CVE-2026-112097: SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting
A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactionshandler.php?action=savesale of the component Sales Management Handler. The manipulation of the argument HsnCode results in cross site scripting. It is possible to launch the attack remotely.
Affected Software
Event History
Frequently Asked Questions
What access and interaction are required to exploit this issue?
The attack can be launched remotely, but the supplied CVSS vector indicates the attacker needs low-level privileges and user interaction. The vulnerable input is the Hsn_Code argument submitted to the save_sale action.
Which deployments are known to be affected?
SourceCodester Inventory System version 1.0 is identified as affected. The provided information does not establish whether other versions or default configurations are affected.
How can defenders look for exploitation attempts?
Review requests to /api/transactions_handler.php?action=save_sale, particularly Hsn_Code values containing script markup or other unexpected HTML/JavaScript content. Also review stored sales-related records and pages that render Hsn_Code values for untrusted content.