Vulnerability · Published Jul 16, 2025 · Assigned by INCIBE
CVE-2025-40724Stored Cross-Site Scripting (XSS) in Pharmacy POS PHP Script
Medium 5.1
In plain English
A medium-severity cross-site scripting in Pharmacy POS PHP Script from Pharmacy POS PHP Script. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Official description
Stored Cross-Site Scripting (XSS) vulnerability in Pharmacy POS PHP Script. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the u_medicine_name parameter in /edit_medicine.php. This vulnerability can be exploited to steal sensitive user data such as session cookies or to perform actions on behalf of the user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Pharmacy POS PHP Script | Pharmacy POS PHP Script | all versions |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N