CVE-2026-11518

MediumCVSS 4.3/10Last modified Jul 23, 2026

Description

A vulnerability was identified in SourceCodester Inventory System 1.0. Affected is an unknown function of the file /users.php of the component User Management Page. The manipulation of the argument fullname/username leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Jun 8, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1151832.4The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities iCVE-2026-1151889.9An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, tCVE-2026-1151898.8A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict userCVE-2026-115196.3A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of thCVE-2026-1151908.0An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties.CVE-2026-1151917.1A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameterCVE-2026-1151927.1An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the CVE-2026-1151938.2A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields aCVE-2026-1151946.5A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not reCVE-2026-1151956.5A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for seveCVE-2026-1151965.4An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the applicCVE-2026-11529.8A security vulnerability has been detected in technical-laohu mpay up to 1.2.4. The impacted element is an unknown function of the component
CVE-2026-11518: Medium severity, CVSS 4.3 | Vulnix