CVE-2026-85207

LowCVSS 3.5

Published: 03/09/2026(UTC)Updated: 05/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0 in the file /index.php?q=orderdetails. Manipulation of the location argument leads to reflected XSS. The attack can be launched remotely and the exploit is publicly available.

Risk Assessment

An attacker can exploit the vulnerability to execute scripts in the victim's browser, potentially leading to session theft, account takeover, or phishing attacks.

Recommendation

Apply a patch or update that filters and validates input for the location argument, and consider using XSS prevention mechanisms.

Other vulnerabilities in Online Medicine Delivery System

CVE-2026-85186Medium
The Online Medicine Delivery System 1.0 by itsourcecode contains an unrestricted file upload vulnerability in the doupdateimage function in /customer/controller.php?action=photos. Manipulation of the photo argument can lead to unrestricted upload.

Original NVD description (English source)

A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS