CVE-2026-10255
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Pharmacy Sales and Inventory System 1.0 has a vulnerability in the sell_statement function of application/controllers/ShowForm.php, leading to improper access controls.
Risk Assessment
An attacker can remotely gain unauthorized access to system functions, potentially resulting in data leakage or manipulation.
Recommendation
Apply patches from the vendor or restrict access to the vulnerable file through firewall rules and authentication.
Other vulnerabilities in Pharmacy Sales and Inventory System
See all- CVE-2026-10248Medium
A CSV injection vulnerability was found in Pharmacy Sales and Inventory System up to version 1.0. The issue occurs in the supplier creation interface where the Address/Company Name arguments are improperly handled. Remote exploitation is possible and the exploit is publicly available.
- CVE-2026-7199High
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_product. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Original NVD description (English source)
A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is the function sell_statement of the file application/controllers/ShowForm.php. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.