{"id":"CVE-2026-11520","state":"PUBLISHED","title":"SourceCodester Inventory System header.php cross site scripting","description":"A weakness has been identified in SourceCodester Inventory System 1.0. Affected by this issue is some unknown functionality of the file header.php. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Multiple parameters might be affected.","publishedAt":"2026-06-08T14:00:15.441Z","updatedAt":"2026-06-09T14:36:08.852Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Inventory System"],"affected":[{"vendor":"SourceCodester","product":"Inventory System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:inventory_system:*:*:*:*:*:*:*:*"]}],"references":["https://vuldb.com/vuln/369140","https://vuldb.com/vuln/369140/cti","https://vuldb.com/cve/CVE-2026-11520","https://vuldb.com/submit/836393","https://www.sourcecodester.com/"],"weaknesses":["CWE-79","CWE-94"],"ingestedAt":"2026-10-29T20:10:52.580Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/11xxx/CVE-2026-11520.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-11520","state":"PUBLISHED","datePublished":"2026-06-08T14:00:15.441Z","dateUpdated":"2026-06-09T14:36:08.852Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-06-07T16:01:24.873Z"},"containers":{"cna":{"title":"SourceCodester Inventory System header.php cross site scripting","descriptions":[{"lang":"en","value":"A weakness has been identified in SourceCodester Inventory System 1.0. Affected by this issue is some unknown functionality of the file header.php. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Multiple parameters might be affected."}],"affected":[{"vendor":"SourceCodester","product":"Inventory System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:inventory_system:*:*:*:*:*:*:*:*"]}],"references":[{"url":"https://vuldb.com/vuln/369140","name":"VDB-369140 | SourceCodester Inventory System header.php cross site scripting","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/369140/cti","name":"VDB-369140 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-11520","name":"CVE-2026-11520 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/836393","name":"Submit #836393 | SourceCodester Inventory System using PHP and MySQL Source Code 0 Cross Site Scripting","tags":["third-party-advisory"]},{"url":"https://www.sourcecodester.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":3.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":3.5,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-06-08T14:00:15.441Z"},"timeline":[{"time":"2026-06-07T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-06-07T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-06-07T18:06:35.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Kamran Saifullah (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB Vulnerability Moderation Team","type":"coordinator"}],"tags":["x_freeware"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-09T14:21:59.021413Z","id":"CVE-2026-11520","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-09T14:36:08.852Z"}}]}}}