CVE-2026-112096

LowCVSS 3.5/10Last modified Oct 19, 2026

Description

A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactions_handler.php?action=save_purchase of the component Purchase Records Handler. The manipulation of the argument Product_Name/Product_Code/Vendor_Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2026
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1120973.5A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactions_h CVE-2026-1120986.3A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py CVE-2026-11219.8A vulnerability was found in Yonyou KSOA 9.0. This affects an unknown function of the file /worksheet/del_workplan.jsp of the component HTTP CVE-2026-112106.5Inappropriate implementation in Safe Browsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary acce CVE-2026-1121005.5A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ of the file deepp CVE-2026-1121014.3A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the fil CVE-2026-1121026.3A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src CVE-2026-1121033.7A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of CVE-2026-1121047.3A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of th CVE-2026-1121053.7A vulnerability has been found in GlitterWare Passy up to 1.10.1. The affected element is the function MyHttpOverrides in the library lib/ma CVE-2026-1121063.7A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d. Affecte CVE-2026-1121076.3A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/mod