CVE-2026-5810
LOWSourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting
Title source: cnaDescription
A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /delete.php of the component GET Parameter Handler. This manipulation of the argument ID causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used.
References (5)
Core 5
Core References
Exploit exploit
https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-Delete-id.md
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-356246 | SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting
https://vuldb.com/vuln/356246
Signature, Permissions Required signature
permissions-required
VDB-356246 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/356246/cti
Third Party Advisory third-party-advisory
Submit #787670 | SourceCodester Sales and Inventory System 1.0 Cross Site Scripting
https://vuldb.com/submit/787670
Product product
https://www.sourcecodester.com/
Scores
CVSS v3
3.5
EPSS
0.0024
EPSS Percentile
14.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
CWE-94
Status
published
Products (1)
SourceCodester/Sales and Inventory System
1.0
Published
Apr 08, 2026
Tracked Since
Apr 09, 2026