CVE-2026-10246

A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0, allowing XSS in the create_generic_name function via the generic_name argument. The attack is remotely exploitable and the exploit is public.

The create_supplier function in /ShowForm/create_supplier/main in SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to XSS via manipulation of the company_name argument. The attack can be performed remotely and the exploit is publicly available.

The create_medicine_name function in /ShowForm/create_medicine_name/main in SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to XSS via manipulation of the medicine_name argument. The attack can be performed remotely and the exploit is publicly available.

A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Manipulation of the argument ID in the file /ajax.php?action=save_customer leads to SQL injection.

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0, affecting an unknown function of the file /ajax.php?action=delete_customer. Manipulating the ID argument can lead to SQL injection.

A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function delete_supplier of the file /ajax.php?action=delete_supplier. Such manipulation of the argument ID leads to SQL injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function save_supplier of the file /ajax.php?action=save_supplier. This manipulation of the argument ID causes SQL injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0 in the Customer function of /index.php?page=customer. Manipulating the Name argument results in cross-site scripting. The attack may be launched remotely, and the exploit is now public and may be used.

A security flaw was discovered in SourceCodester Pharmacy Sales and Inventory System 1.0 in the save_expired function of the file /ajax.php?action=save_expired. Manipulation of the ID argument results in SQL injection. The attack can be launched remotely and the exploit has been publicly released.

A vulnerability was identified in SourceCodester Pharmacy Sales and Inventory System 1.0 in the delete_expired function of /ajax.php?action=delete_expired. Manipulating the ID argument leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.