CVE-2026-10247
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0, allowing XSS in the create_generic_name function via the generic_name argument. The attack is remotely exploitable and the exploit is public.
Risk Assessment
An attacker can inject malicious scripts, potentially leading to data theft or session hijacking.
Recommendation
Update the system to the latest version or apply input filtering for the generic_name argument.
Other vulnerabilities in SourceCodester Pharmacy Sales and Inventory System
See all- CVE-2026-7550High
A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Manipulation of the argument ID in the file /ajax.php?action=save_customer leads to SQL injection.
- CVE-2026-7549High
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0, affecting an unknown function of the file /ajax.php?action=delete_customer. Manipulating the ID argument can lead to SQL injection.
- CVE-2026-10246Low
A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0, allowing XSS in the create_medicine_presentation function via the medicine_presentation argument. The attack is remotely exploitable and the exploit is public.
- CVE-2026-10245Low
The create_supplier function in /ShowForm/create_supplier/main in SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to XSS via manipulation of the company_name argument. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-10244Low
The create_medicine_name function in /ShowForm/create_medicine_name/main in SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to XSS via manipulation of the medicine_name argument. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-7200Medium
A cross-site scripting vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0 in the file /index.php?page=types via manipulation of the ID argument. The attack can be launched remotely.
- CVE-2026-7194High
A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0 in the file /ajax.php?action=save_product. Manipulation of the ID argument causes SQL injection. The attack can be carried out remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. This vulnerability affects the function create_generic_name of the file /ShowForm/create_generic_name/main. The manipulation of the argument generic_name results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS