CVE-2026-10244
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The create_medicine_name function in /ShowForm/create_medicine_name/main in SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to XSS via manipulation of the medicine_name argument. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
An attacker can inject a malicious script, potentially leading to data theft or session hijacking.
Recommendation
Update the system to the latest version or apply input filtering for the medicine_name argument.
Other vulnerabilities in SourceCodester Pharmacy Sales and Inventory System
See all- CVE-2026-7550High
A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Manipulation of the argument ID in the file /ajax.php?action=save_customer leads to SQL injection.
- CVE-2026-7549High
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0, affecting an unknown function of the file /ajax.php?action=delete_customer. Manipulating the ID argument can lead to SQL injection.
- CVE-2026-10247Low
A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0, allowing XSS in the create_generic_name function via the generic_name argument. The attack is remotely exploitable and the exploit is public.
- CVE-2026-10246Low
A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0, allowing XSS in the create_medicine_presentation function via the medicine_presentation argument. The attack is remotely exploitable and the exploit is public.
- CVE-2026-10245Low
The create_supplier function in /ShowForm/create_supplier/main in SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to XSS via manipulation of the company_name argument. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-7200Medium
A cross-site scripting vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0 in the file /index.php?page=types via manipulation of the ID argument. The attack can be launched remotely.
- CVE-2026-7194High
A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0 in the file /ajax.php?action=save_product. Manipulation of the ID argument causes SQL injection. The attack can be carried out remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is the function create_medicine_name of the file /ShowForm/create_medicine_name/main. Performing a manipulation of the argument medicine_name results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS