CVE-2026-90696

Name of the Vulnerable Software and Affected Versions SourceCodester Inventory Management System version 1.0

Description A remote cross site scripting issue exists within the Product Management Module. The flaw is located in the /api/products handler.php endpoint, where manipulating the Product Name variable allows for the execution of malicious scripts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the Product Name parameter in the /api/products handler.php endpoint until the issue is resolved.