Low severity · published Jun 8, 2026
CVE-2026-11520
SourceCodester Inventory System header.php cross site scripting
3.5
CVSS
0.2%
EPSS
No
On KEV
Description
A weakness has been identified in SourceCodester Inventory System 1.0. Affected by this issue is some unknown functionality of the file header.php. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Multiple parameters might be affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
Inventory System · SourceCodester
1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11520
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11520
vuldb.com
https://vuldb.com/cve/CVE-2026-11520
vuldb.com
https://vuldb.com/submit/836393
vuldb.com
https://vuldb.com/vuln/369140
vuldb.com
https://vuldb.com/vuln/369140/cti
www.sourcecodester.com
https://www.sourcecodester.com/
More from Inventory System
6.3
CVE-2026-11519
SourceCodester Inventory System Account Creation users_handler.php improper authorization
4.3
CVE-2026-11518
SourceCodester Inventory System User Management users.php cross site scripting
3.5
CVE-2026-112097
SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting
3.5
CVE-2026-112096
SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting
3.5
CVE-2026-112095
SourceCodester Inventory System Product Management products_handler.php save cross site scripting