Vulnerability · Published Apr 28, 2026 · Assigned by VulDB
CVE-2026-7269SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting
Low 2.4
In plain English
A low-severity cross-site scripting in Pharmacy Sales and Inventory System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Official description
A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected is an unknown function of the file /index.php?page=product. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SourceCodester | Pharmacy Sales and Inventory System | 1.0 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
References
- VDB-359920 | SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting vdb-entry, technical-description
- VDB-359920 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #802757 | sourcecodester Pharmacy Sales and Inventory System V1.0 cross site scripting third-party-advisory
- Submit #802758 | sourcecodester Pharmacy Sales and Inventory System V1.0 cross site scripting (Duplicate) third-party-advisory
- https://github.com/zulu225588/zulu-loudong/issues/3 exploit, issue-tracking
- https://www.sourcecodester.com/ product