A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in the view_product.php file via the "limit" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.
References
| Link | Resource |
|---|---|
| https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-ViewProduct-limit.md | Exploit Third Party Advisory |
Configurations
History
30 Mar 2026, 17:19
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| References | () https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-ViewProduct-limit.md - Exploit, Third Party Advisory | |
| First Time |
Ahsanriaz26gmailcom
Ahsanriaz26gmailcom inventory System |
|
| CPE | cpe:2.3:a:ahsanriaz26gmailcom:inventory_system:1.0:*:*:*:*:*:*:* | |
| CWE | CWE-79 |
30 Mar 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in the view_product.php file via the "limit" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL. |
Information
Published : 2026-03-27 18:16
Updated : 2026-03-30 17:19
NVD link : CVE-2026-30567
Mitre link : CVE-2026-30567
CVE.ORG link : CVE-2026-30567
JSON object : View
Products Affected
ahsanriaz26gmailcom
- inventory_system
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')