SourceCodester Inventory System 1.0: Three XSS Flaws Found in API Handlers
Key findings • Three low-severity XSS vulnerabilities disclosed together in SourceCodester Inventory System 1.0. • Vulnerabilities affect API handlers for sales, purchases, and product manage…
Key findings
- Three low-severity XSS vulnerabilities disclosed together in SourceCodester Inventory System 1.0.
- Vulnerabilities affect API handlers for sales, purchases, and product management.
- Exploitation of arguments like Hsn_Code, Product_Name, and Product_Id can lead to script injection.
- All disclosed on October 19, 2026, with a CVSSv3 score of 3.5 each.
On October 19, 2026, three low-severity Cross-Site Scripting (XSS) vulnerabilities were disclosed together in SourceCodester Inventory System 1.0. These vulnerabilities, all stemming from improper handling of user-supplied input in API endpoints, could allow remote attackers to inject malicious scripts into web pages viewed by other users.
The vulnerabilities were found in different components of the Sales Management, Purchase Records, and Product Management handlers, all accessible via API calls. Specifically, CVE-2026-112097 affects the /api/transactions_handler.php?action=save_sale endpoint, where manipulation of the Hsn_Code argument can lead to XSS. Similarly, CVE-2026-112096 impacts the /api/transactions_handler.php?action=save_purchase endpoint, with vulnerabilities arising from the manipulation of Product_Name, Product_Code, or Vendor_Name. Lastly, CVE-2026-112095 is present in the /api/products_handler.php?action=save endpoint, where arguments like Product_Id or Product_Name can be manipulated to achieve XSS.
All three vulnerabilities share the same low severity rating (CVSSv3 3.5) and were disclosed on the same day, indicating a potential cluster of related coding errors. While the descriptions do not mention active exploitation in the wild or specific threat actors, the nature of XSS vulnerabilities means that successful attacks could lead to session hijacking, credential theft, or defacement of the application's interface.
SourceCodester Inventory System 1.0 is affected by these issues. As of the disclosure, no specific patch information or updated version numbers were provided in the vulnerability details. Users are advised to consult SourceCodester's official advisories for any available updates or mitigation strategies.
The disclosure of these three XSS vulnerabilities highlights the importance of secure coding practices, particularly in API endpoints that handle user-generated data. Developers should prioritize input validation and output encoding to prevent script injection attacks. Users of SourceCodester Inventory System 1.0 should remain vigilant for any security updates released by the vendor to address these weaknesses.