CVE-2026-90695

2.0 lowEPSS 0.3%

Low (2.0). EPSS 0.3% chance of exploitation in the next 30 days.

A vulnerability was found in SourceCodester Inventory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /api/vendors_handler.php of the component Vendor Management. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

Severity

CVSS 4.0

2.0 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

CVSS 3.1

3.5 low

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-94
Published: 2026-09-14
Modified: 2026-09-16
Record from: the NVD, synced 2026-10-19

References

https://gist.github.com/fhewm98/5eaa9df770357351917f4538a3032eb7
https://vuldb.com/cve/CVE-2026-90695
https://vuldb.com/submit/916037
https://vuldb.com/vuln/403228
https://vuldb.com/vuln/403228/cti

Check your stack JSON