Mohammed Faheem

**Name of the Vulnerable Software and Affected Versions** SourceCodester Inventory Management System version 1.0 **Description** Cross site scripting (XSS) occurs in the Customer Management Module due to improper handling of the `Customer Name` argument within the `/api/customers handler.php` endpoint. This issue allows a remote attacker to execute malicious scripts in the context of a user's session. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `Customer Name` argument in the `/api/customers handler.php` endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Inventory Management System version 1.0 **Description** An issue exists within the Vendor Management component in the file `/api/vendors handler.php` (API Endpoint). A remote attacker can perform a manipulation that results in cross site scripting, a technique where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Inventory Management System version 1.0 **Description** A remote cross site scripting issue exists within the Product Management Module. The flaw is located in the `/api/products handler.php` endpoint, where manipulating the `Product Name` variable allows for the execution of malicious scripts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `Product Name` parameter in the `/api/products handler.php` endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Inventory Management System version 1.0 **Description** An authorization bypass exists in the `invoice.php` file. A remote attacker can exploit this by manipulating the `ID` argument, allowing them to bypass security checks and gain unauthorized access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.