CVE-2026-10244
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The create_medicine_name function in /ShowForm/create_medicine_name/main in SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to XSS via manipulation of the medicine_name argument. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
An attacker can inject a malicious script, potentially leading to data theft or session hijacking.
Recommendation
Update the system to the latest version or apply input filtering for the medicine_name argument.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is the function create_medicine_name of the file /ShowForm/create_medicine_name/main. Performing a manipulation of the argument medicine_name results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used.