CVE-2026-90697: SourceCodester Inventory Management System invoice.php authorization
Published Sep 14, 2026
·Updated
A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Affected Software
1 affected component
Sourcecodester Inventory Management System=1.0
Event History
Sep 14, 2026
CVE Published
via MITRE·08:15 AM
Data Sourced
via MITRE·08:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The vector indicates that the attacker needs low-level privileges (PR:L). The attack can be performed remotely and does not require user interaction.
2
What is the likely impact of successful exploitation?
Successful exploitation allows an authorization bypass involving the ID argument in invoice.php. The supplied metrics indicate low confidentiality impact and no integrity or availability impact.
3
Is exploit code available?
Yes. The exploit is publicly available and may be used by attackers.