CVE-2026-8136
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0 affecting an unknown part of the file /index.php?page=users. Manipulation of the Name argument can lead to cross-site scripting. The attack may be launched remotely, and the exploit has been published and may be used.
Risk Assessment
The XSS vulnerability may allow execution of malicious script in a user's browser, session theft, or account takeover, and the public exploit increases the risk of exploitation.
Recommendation
Apply patches or update the system, and until available, implement input validation and filtering of the Name argument.
Other vulnerabilities in Pharmacy Sales and Inventory System
See all- CVE-2026-10255Medium
Pharmacy Sales and Inventory System 1.0 has a vulnerability in the sell_statement function of application/controllers/ShowForm.php, leading to improper access controls.
- CVE-2026-10248Medium
A CSV injection vulnerability was found in Pharmacy Sales and Inventory System up to version 1.0. The issue occurs in the supplier creation interface where the Address/Company Name arguments are improperly handled. Remote exploitation is possible and the exploit is publicly available.
- CVE-2026-7199High
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_product. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
- CVE-2026-7129Medium
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. It affects an unknown function of the file /index.php?page=categories. Manipulation of the ID argument results in cross site scripting.
Original NVD description (English source)
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /index.php?page=users. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS