CVE-2026-90694 Details

A stored cross-site scripting vulnerability has been identified in SourceCodester Inventory Management System version 1.0. The issue resides in the Customer Management Module, specifically within the file '/api/customers_handler.php'. The vulnerability is triggered by manipulating the 'Customer_Name' parameter, which is not properly sanitized before being stored in the database. As a result, injected JavaScript is executed in the browsers of users who view the Customer List page, potentially leading to session hijacking and account takeover.

To address this vulnerability, apply proper input validation and output encoding. Use 'htmlspecialchars()' to sanitize user input before rendering it in HTML. Implement server-side validation to reject HTML tags, and consider applying Content Security Policy (CSP) headers to mitigate the impact of any potential script injection.