CVE-2026-90697
SourceCodester Inventory Management System invoice.php authorization
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 14, 2026
- Updated
- Sep 15, 2026
- Reserved
- Sep 13, 2026
Description
A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Inventory Management SystemSourceCodester |
|
References
- VDB-403230 | SourceCodester Inventory Management System invoice.php authorizationvdb-entrytechnical-description
- VDB-403230 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-90697 | CVE Analysis and Reportthird-party-advisory
- Submit #916047 | SourceCodester Inventory-Management-System-PHP 1.0 Missing Authorizationthird-party-advisory
- https://gist.github.com/fhewm98/079112d415afa63ed1368a798a352665exploit
- https://www.sourcecodester.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.