CVE-2026-112097
Received Received - Intake

XSS in SourceCodester Inventory System via Hsn_Code Parameter

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactions_handler.php?action=save_sale of the component Sales Management Handler. The manipulation of the argument Hsn_Code results in cross site scripting. It is possible to launch the attack remotely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112097
EUVD
EUVD-2026-104126

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SourceCodester Inventory System 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in SourceCodester Inventory System 1.0. It allows attackers to inject malicious scripts via the Hsn_Code parameter in the /api/transactions_handler.php file when saving sales. The injected scripts are stored in the database and executed in users' browsers, particularly when admin users view sales pages.

Detection Guidance

To detect this XSS vulnerability, inspect network traffic for POST requests to /api/transactions_handler.php?action=save_sale with parameters like Hsn_Code containing suspicious JavaScript payloads. Check if responses render untrusted input without proper escaping. Review database entries for injected scripts in fields like Product_Name or Customer_Name.

Impact Analysis

An attacker can steal session cookies, leading to full account takeover. They can access sensitive data like customer PII and financial records. The attack starts with a low-privileged user injecting XSS payloads, which execute when an admin views the sales page. The stolen session cookie (PHPSESSID) enables unauthorized access.

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. It may result in data breaches, non-compliance penalties, and loss of trust due to exposure of customer PII and financial records.

Mitigation Strategies

Immediately sanitize all user inputs (Product_Name, Customer_Name, Hsn_Code) before storage. Implement output encoding when rendering data with DataTables. Set the HttpOnly flag on session cookies to prevent theft. Update to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112097. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart