CVE-2026-11519

MediumCVSS 6.3/10Last modified Jul 23, 2026

Description

A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /Product_Inventory/api/users_handler.php of the component Account Creation Handler. The manipulation of the argument ROLE results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-266 CWE-285

Affected software

No affected versions have been published.

Timeline

Published: Jun 8, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1151908.0An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties.CVE-2026-1151917.1A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter CVE-2026-1151927.1An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the CVE-2026-1151938.2A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields a CVE-2026-1151946.5A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not re CVE-2026-1151956.5A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for seve CVE-2026-1151965.4An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the applic CVE-2026-11529.8A security vulnerability has been detected in technical-laohu mpay up to 1.2.4. The impacted element is an unknown function of the component CVE-2026-115203.5A weakness has been identified in SourceCodester Inventory System 1.0. Affected by this issue is some unknown functionality of the file head CVE-2026-1152048.8The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a CVE-2026-1152056.5The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, all CVE-2026-1152075.5A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or