Vulnerability · Published Apr 28, 2026 · Assigned by VulDB
CVE-2026-7281SourceCodester Pharmacy Sales and Inventory System index.php supplier cross site scripting
Low 2.4
In plain English
A low-severity cross-site scripting in Pharmacy Sales and Inventory System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Official description
A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System 1.0. The impacted element is the function supplier of the file /index.php?page=supplier. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SourceCodester | Pharmacy Sales and Inventory System | 1.0 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
References
- VDB-359939 | SourceCodester Pharmacy Sales and Inventory System index.php supplier cross site scripting vdb-entry, technical-description
- VDB-359939 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #803017 | sourcecodester Pharmacy Sales and Inventory System V1.0 cross site scripting third-party-advisory
- https://github.com/CDipper/CVE-Test/issues/3 exploit, issue-tracking
- https://www.sourcecodester.com/ product