CVE-2026-7194
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0 in the file /ajax.php?action=save_product. Manipulation of the ID argument causes SQL injection. The attack can be carried out remotely and the exploit is publicly available.
Risk Assessment
An attacker can remotely manipulate the database, potentially leading to data leakage or modification.
Recommendation
Immediately update the system or apply a patch to prevent SQL injection.
Other vulnerabilities in SourceCodester Pharmacy Sales and Inventory System
See all- CVE-2026-7550High
A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Manipulation of the argument ID in the file /ajax.php?action=save_customer leads to SQL injection.
- CVE-2026-7549High
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0, affecting an unknown function of the file /ajax.php?action=delete_customer. Manipulating the ID argument can lead to SQL injection.
- CVE-2026-10247Low
A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0, allowing XSS in the create_generic_name function via the generic_name argument. The attack is remotely exploitable and the exploit is public.
- CVE-2026-10246Low
A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0, allowing XSS in the create_medicine_presentation function via the medicine_presentation argument. The attack is remotely exploitable and the exploit is public.
- CVE-2026-10245Low
The create_supplier function in /ShowForm/create_supplier/main in SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to XSS via manipulation of the company_name argument. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-10244Low
The create_medicine_name function in /ShowForm/create_medicine_name/main in SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to XSS via manipulation of the medicine_name argument. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-7200Medium
A cross-site scripting vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0 in the file /index.php?page=types via manipulation of the ID argument. The attack can be launched remotely.
Original NVD description (English source)
A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=save_product. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.