CVE-2025-65215
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Sourcecodester Web-based Pharmacy Product Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /product_expiry/add-supplier.php via the Supplier Name field. User-supplied input is not properly sanitized.
Risk Assessment
An attacker can inject malicious JavaScript that executes in the browser of an administrator or other users, enabling session theft or content manipulation.
Recommendation
Implement input validation and encoding for the Supplier Name field and apply Content-Security-Policy headers. Update the application to a patched version.
Other vulnerabilities in Sourcecodester Web-based Pharmacy Product Management System
See all- CVE-2026-7746Medium
A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0, affecting an unknown function of the /product_expiry/edit-admin.php file. Manipulation of the ID argument leads to SQL injection, and the attack can be launched remotely. The exploit is publicly available and might be used.
- CVE-2025-56274High
SourceCodester Web-based Pharmacy Product Management System 1.0 is vulnerable to Incorrect Access Control, allowing low-privileged users to forge high-privileged (e.g., admin) sessions and perform sensitive operations such as adding new users.
Original NVD description (English source)
Sourcecodester Web-based Pharmacy Product Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /product_expiry/add-supplier.php via the Supplier Name field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS