CVE-2026-5812
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A business logic error has been discovered in SourceCodester Pharmacy Product Management System 1.0 in the file add-sales.php, within the POST Parameter Handler component. Manipulating the txtqty argument leads to business logic errors. The attack can be performed remotely and the exploit has been publicly released.
Risk Assessment
The risk involves potential manipulation of the sales process, leading to incorrect quantity calculations, financial losses, or data integrity issues.
Recommendation
Immediately apply patches from the vendor or temporarily disable the add-sales functionality until the vulnerability is fixed.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Pharmacy Product Management System 1.0. This affects an unknown part of the file add-sales.php of the component POST Parameter Handler. Performing a manipulation of the argument txtqty results in business logic errors. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.