CVE-2026-85186

MediumCVSS 6.3

Published: 03/09/2026(UTC)Updated: 04/09/2026(UTC)Translated: 03/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

The Online Medicine Delivery System 1.0 by itsourcecode contains an unrestricted file upload vulnerability in the doupdateimage function in /customer/controller.php?action=photos. Manipulation of the photo argument can lead to unrestricted upload.

Risk Assessment

A remote attacker can upload malicious files, potentially leading to code execution on the server, system compromise, or data theft.

Recommendation

Apply vendor patches or restrict access to the file upload functionality, and validate file types and contents.

Other vulnerabilities in Online Medicine Delivery System

CVE-2026-85207Low
A cross-site scripting (XSS) vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0 in the file /index.php?q=orderdetails. Manipulation of the location argument leads to reflected XSS. The attack can be launched remotely and the exploit is publicly available.

Original NVD description (English source)

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /customer/controller.php?action=photos of the component Customer Controller. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS