CVE-2026-7200
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A cross-site scripting vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0 in the file /index.php?page=types via manipulation of the ID argument. The attack can be launched remotely.
Risk Assessment
An attacker can inject malicious scripts that execute in the victim's browser, potentially leading to session theft or other actions on the user's account.
Recommendation
Apply proper input filtering and output encoding for the ID argument in /index.php?page=types. Contact the vendor for an official patch.
Original NVD description (English source)
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /index.php?page=types. Executing a manipulation of the argument ID can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.