CVE-2026-11519: medium-severity vulnerability in SourceCodester Inventory System
SourceCodester Inventory System Account Creation users_handler.php improper authorization
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /Product_Inventory/api/users_handler.php of the component Account Creation Handler. The manipulation of the argument ROLE results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
SourceCodester · Inventory SystemRelated CVEs — SourceCodester Inventory System
In the same product, most dangerous first.
CVE-2026-11518MEDIUMSourceCodester Inventory System User Management users.php cross site scriptingEPSS 0.4%CVE-2026-11520MEDIUMSourceCodester Inventory System header.php cross site scriptingEPSS 0.2%CVE-2026-112097MEDIUMSourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scriptingEPSS 0.2%CVE-2026-112096MEDIUMSourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scriptingEPSS 0.2%CVE-2026-112095MEDIUMSourceCodester Inventory System Product Management products_handler.php save cross site scriptingEPSS 0.2%