CVE-2026-7391
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function save_supplier of the file /ajax.php?action=save_supplier. This manipulation of the argument ID causes SQL injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Risk Assessment
A remote attacker can execute arbitrary SQL queries, potentially resulting in addition or modification of supplier data. The public availability of the exploit increases the risk of attack.
Recommendation
Update the system to a patched version or implement SQL query parameterization and input validation. Restrict access to administrative functions.
Other vulnerabilities in SourceCodester Pharmacy Sales and Inventory System
See all- CVE-2026-10247Low
A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0, allowing XSS in the create_generic_name function via the generic_name argument. The attack is remotely exploitable and the exploit is public.
- CVE-2026-10246Low
A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0, allowing XSS in the create_medicine_presentation function via the medicine_presentation argument. The attack is remotely exploitable and the exploit is public.
- CVE-2026-10245Low
The create_supplier function in /ShowForm/create_supplier/main in SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to XSS via manipulation of the company_name argument. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-10244Low
The create_medicine_name function in /ShowForm/create_medicine_name/main in SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to XSS via manipulation of the medicine_name argument. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-7550High
A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Manipulation of the argument ID in the file /ajax.php?action=save_customer leads to SQL injection.
- CVE-2026-7549High
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0, affecting an unknown function of the file /ajax.php?action=delete_customer. Manipulating the ID argument can lead to SQL injection.
- CVE-2026-7392Medium
A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function delete_supplier of the file /ajax.php?action=delete_supplier. Such manipulation of the argument ID leads to SQL injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
- CVE-2026-7390Low
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0 in the Customer function of /index.php?page=customer. Manipulating the Name argument results in cross-site scripting. The attack may be launched remotely, and the exploit is now public and may be used.
- CVE-2026-7283Medium
A security flaw was discovered in SourceCodester Pharmacy Sales and Inventory System 1.0 in the save_expired function of the file /ajax.php?action=save_expired. Manipulation of the ID argument results in SQL injection. The attack can be launched remotely and the exploit has been publicly released.
- CVE-2026-7282Medium
A vulnerability was identified in SourceCodester Pharmacy Sales and Inventory System 1.0 in the delete_expired function of /ajax.php?action=delete_expired. Manipulating the ID argument leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.
Original NVD description (English source)
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function save_supplier of the file /ajax.php?action=save_supplier. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS