CVE-2026-90695: SourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scripting
A vulnerability was found in SourceCodester Inventory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /api/vendorshandler.php of the component Vendor Management. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker needs low-level privileges and user interaction to exploit the cross-site scripting issue. The provided data does not identify the specific affected parameter or the exact privilege level required.
Is exploit activity a practical concern?
Yes. A public exploit is available, so attackers could use existing exploit material rather than developing an exploit from scratch.
Does this affect default installations?
The available information identifies SourceCodester Inventory Management System 1.0 and the Vendor Management component, but does not state whether the vulnerable functionality is enabled or reachable in a default installation.
How can I determine whether my deployment is affected?
Confirm whether the deployment runs SourceCodester Inventory Management System version 1.0 and exposes or uses /api/vendors_handler.php for Vendor Management. The supplied data does not provide a payload, affected input field, or detection indicator for confirming successful exploitation.