CVE-2026-30567 - Vulnerability Analysis

Overview

SourceCodester Inventory System 1.0 contains a reflected XSS caused by unsanitized "limit" parameter in view_product.php, letting remote attackers inject arbitrary web scripts via crafted URL, exploit requires no special privileges.

Severity & Score

Impact

Remote attackers can execute arbitrary scripts in users' browsers, potentially stealing session data or performing actions on behalf of users.

Mitigation

Update to the latest version or apply input sanitization to the "limit" parameter.

References

• https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-ViewProduct-limit.md

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner