CVE-2026-90697CWE-285CWE-639

CVE-2026-90697

Medium · published September 14, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
34.6
In the wild
Unconfirmed
What it is

A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00414 · 34.6th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-14T13:17Z
References (6)
https://gist.github.com/fhewm98/079112d415afa63ed1368a798a352665 · [email protected]https://vuldb.com/cve/CVE-2026-90697 · [email protected]https://vuldb.com/submit/916047 · [email protected]https://vuldb.com/vuln/403230 · [email protected]https://vuldb.com/vuln/403230/cti · [email protected]https://www.sourcecodester.com/ · [email protected]
EPSS history
Timeline
  • 15 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 14 SEP 08:15Z
    SourceCodester Inventory Management System invoice.php authorization
    cvelistv5