CVE-2026-7390
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0 in the Customer function of /index.php?page=customer. Manipulating the Name argument results in cross-site scripting. The attack may be launched remotely, and the exploit is now public and may be used.
Risk Assessment
The XSS vulnerability may allow an attacker to execute malicious script in a user's browser, potentially leading to session or data theft. Public exploit availability increases the risk of exploitation.
Recommendation
Update to a patched version or implement input validation and encoding. Until patched, restrict access to the application.
Other vulnerabilities in SourceCodester Pharmacy Sales and Inventory System
See all- CVE-2026-10247Low
A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0, allowing XSS in the create_generic_name function via the generic_name argument. The attack is remotely exploitable and the exploit is public.
- CVE-2026-10246Low
A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0, allowing XSS in the create_medicine_presentation function via the medicine_presentation argument. The attack is remotely exploitable and the exploit is public.
- CVE-2026-10245Low
The create_supplier function in /ShowForm/create_supplier/main in SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to XSS via manipulation of the company_name argument. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-10244Low
The create_medicine_name function in /ShowForm/create_medicine_name/main in SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to XSS via manipulation of the medicine_name argument. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-7550High
A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Manipulation of the argument ID in the file /ajax.php?action=save_customer leads to SQL injection.
- CVE-2026-7549High
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0, affecting an unknown function of the file /ajax.php?action=delete_customer. Manipulating the ID argument can lead to SQL injection.
- CVE-2026-7392Medium
A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function delete_supplier of the file /ajax.php?action=delete_supplier. Such manipulation of the argument ID leads to SQL injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
- CVE-2026-7391Medium
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function save_supplier of the file /ajax.php?action=save_supplier. This manipulation of the argument ID causes SQL injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
- CVE-2026-7283Medium
A security flaw was discovered in SourceCodester Pharmacy Sales and Inventory System 1.0 in the save_expired function of the file /ajax.php?action=save_expired. Manipulation of the ID argument results in SQL injection. The attack can be launched remotely and the exploit has been publicly released.
- CVE-2026-7282Medium
A vulnerability was identified in SourceCodester Pharmacy Sales and Inventory System 1.0 in the delete_expired function of /ajax.php?action=delete_expired. Manipulating the ID argument leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. The impacted element is the function Customer of the file /index.php?page=customer. The manipulation of the argument Name results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS