CVE-2026-7746
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0, affecting an unknown function of the /product_expiry/edit-admin.php file. Manipulation of the ID argument leads to SQL injection, and the attack can be launched remotely. The exploit is publicly available and might be used.
Risk Assessment
SQL injection could allow an attacker to read, modify, or delete database data. This may lead to breaches of data confidentiality and integrity.
Recommendation
Implement input validation and parameterized queries in edit-admin.php. Update the application if a patch is available.
Other vulnerabilities in SourceCodester Web-based Pharmacy Product Management System
See all- CVE-2025-65215Medium
Sourcecodester Web-based Pharmacy Product Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /product_expiry/add-supplier.php via the Supplier Name field. User-supplied input is not properly sanitized.
- CVE-2025-56274High
SourceCodester Web-based Pharmacy Product Management System 1.0 is vulnerable to Incorrect Access Control, allowing low-privileged users to forge high-privileged (e.g., admin) sessions and perform sensitive operations such as adding new users.
Original NVD description (English source)
A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected is an unknown function of the file /product_expiry/edit-admin.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS