CVE-2026-104614
MediumCVSS 6.3Summary
A SQL injection vulnerability was discovered in CodeAstro Simple Pharmacy Management System 1.0 in the file /SimplePharmacy-PHP/product/delete.php, affecting the ID argument. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
An attacker can manipulate SQL queries, potentially leading to unauthorized deletion of data or access to sensitive information in the database.
Recommendation
It is recommended to apply patches or update the system immediately, and to validate and sanitize the ID argument in delete.php.
Other vulnerabilities in CodeAstro Simple Pharmacy Management System
Original NVD description (English source)
A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown processing of the file /SimplePharmacy-PHP/product/delete.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS