Zero Day MonitorZDM

← Back to list

6.1

CVE-2026-30566EXPLOITED

n/a · n/a

CVE-2026-30566: A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulner

Description

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the view_customers.php file via the "limit" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.

Affected Products

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-ViewCustomers-limit.md

Related News (1 articles)

Tier C

VulDB5h ago

CVE-2026-30566 | SourceCodester Sales and Inventory System 1.0 Parameter view_customers.php limit cross site scripting

→ No new info (linked only)

CVSS 3.16.1 MEDIUM

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA KEV❌ No

Actively exploited✅ Yes

PublishedMar 30, 2026

Last enriched4h agov2

Trending Score50

Source articles1

Independent1

Info Completeness6/14

Missing: cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-29953EXP

CVE-2026-29953: SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the columnAsInsert function in file plugins

CRITICALCVE-2026-30562EXP

CVE-2026-30562: A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulner

CRITICALCVE-2026-29925EXP

CVE-2026-29925: Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php.

HIGHCVE-2026-29954EXP

CVE-2026-29954: In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing th

MEDIUMCVE-2026-30082EXP

CVE-2026-30082: Multiple stored cross-site scripting (XSS) vulnerabilities in the Edit feature of the Software Package List page of IngE

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Mar 30, 2026

Discovered by ZDM

Mar 30, 2026

Updated: affectedVersions, severity, activelyExploited

Mar 30, 2026

Actively Exploited

Mar 30, 2026

Version History

v2

Last enriched 4h ago

v2Tier C4h ago

Updated vendor and product information, set severity to HIGH, and marked the vulnerability as actively exploited.

affectedVersionsseverityactivelyExploited

via VulDB

v15h ago

Initial creation