CVE-2025-56274
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
SourceCodester Web-based Pharmacy Product Management System 1.0 is vulnerable to Incorrect Access Control, allowing low-privileged users to forge high-privileged (e.g., admin) sessions and perform sensitive operations such as adding new users.
Risk Assessment
The risk involves unauthorized takeover of the system by a low-privileged user, potentially leading to data integrity breaches, creation of unauthorized accounts, and privilege escalation.
Recommendation
Immediately update the system to the latest version or apply the vendor's patch. In the meantime, implement additional authentication and role-based access control mechanisms.
Other vulnerabilities in SourceCodester Web-based Pharmacy Product Management System
See all- CVE-2026-7746Medium
A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0, affecting an unknown function of the /product_expiry/edit-admin.php file. Manipulation of the ID argument leads to SQL injection, and the attack can be launched remotely. The exploit is publicly available and might be used.
- CVE-2025-65215Medium
Sourcecodester Web-based Pharmacy Product Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /product_expiry/add-supplier.php via the Supplier Name field. User-supplied input is not properly sanitized.
Original NVD description (English source)
SourceCodester Web-based Pharmacy Product Management System 1.0 is vulnerable to Incorrect Access Control, which allows low-privileged users to forge high privileged (such as admin) sessions and perform sensitive operations such as adding new users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS