CVE-2026-90694

Name of the Vulnerable Software and Affected Versions SourceCodester Inventory Management System version 1.0

Description Cross site scripting (XSS) occurs in the Customer Management Module due to improper handling of the Customer Name argument within the /api/customers handler.php endpoint. This issue allows a remote attacker to execute malicious scripts in the context of a user's session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the Customer Name argument in the /api/customers handler.php endpoint until the issue is resolved.