CVE-2026-10248
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A CSV injection vulnerability was found in Pharmacy Sales and Inventory System up to version 1.0. The issue occurs in the supplier creation interface where the Address/Company Name arguments are improperly handled. Remote exploitation is possible and the exploit is publicly available.
Risk Assessment
An attacker can inject malicious CSV formulas, potentially leading to unwanted actions in spreadsheet applications used by users exporting data.
Recommendation
Update the system to the latest version or apply a patch to prevent CSV injection. Restrict access to the supplier creation interface.
Other vulnerabilities in Pharmacy Sales and Inventory System
See all- CVE-2026-10255Medium
Pharmacy Sales and Inventory System 1.0 has a vulnerability in the sell_statement function of application/controllers/ShowForm.php, leading to improper access controls.
- CVE-2026-7199High
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_product. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Original NVD description (English source)
A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System up to 1.0. This issue affects the function create_supplier of the file /Export_csv/export of the component Supplier Creation Interface. This manipulation of the argument Address/Company Name causes csv injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.