Multiple stored cross-site scripting (XSS) vulnerabilities in Sourcecodester Equipment Inventory System 1.0 allow remote attackers to inject arbitrary javascript via any \Add\ sections such as Add Item Employee and Position or others in the Name Parameters.