Is there a public PoC exploit available for CVE-2026-10244?

Yes, a public proof-of-concept exploit is available for CVE-2026-10244. Prioritise patching immediately. EPSS: 0.0%.

Pharmacy Sales and Inventory System CVE-2026-10244

Q: What is the CVSS score of CVE-2026-10244?

CVE-2026-10244 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33616 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-01 VulDB

GHSA-m84h-9wm2-4ch9

XSS Pharmacy Sales And Inventory System Sourcecodester

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 11:23 vuln.today

CVSS changed

Jun 01, 2026 - 11:22 NVD

3.5 (LOW) 2.0 (LOW)

DescriptionCVE.org

A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is the function create_medicine_name of the file /ShowForm/create_medicine_name/main. Performing a manipulation of the argument medicine_name results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used.

AnalysisAI

Cross-site scripting in SourceCodester Pharmacy Sales and Inventory System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the medicine_name parameter at the /ShowForm/create_medicine_name/main endpoint, executing arbitrary scripts in the browsers of other users who view the affected page. The CVSS 4.0 score of 2.0 reflects a narrow impact profile - no confidentiality loss and only low integrity impact - but a publicly available proof-of-concept exploit exists (E:P), lowering the barrier to abuse in multi-user deployments such as shared pharmacy management environments. No active exploitation has been confirmed via CISA KEV.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as missing or inadequate output encoding of user-supplied input before it is rendered into HTML. The vulnerable component is the create_medicine_name PHP function exposed at the HTTP endpoint /ShowForm/create_medicine_name/main, where the medicine_name argument is processed and reflected or stored without sanitization. SourceCodester distributes open-source PHP-based web applications intended as learning templates, commonly deployed in shared LAMP-stack environments with minimal hardening. The CPE string cpe:2.3:a:sourcecodester:pharmacy_sales_and_inventory_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not narrowed the affected version range beyond the 1.0 explicitly cited in the description. The CVSS 4.0 vector confirms network reachability (AV:N) with no prerequisite vulnerability chaining (AT:N), consistent with a directly exploitable web input field.

RemediationAI

No vendor-released patch has been identified at time of analysis; SourceCodester open-source applications are typically provided without formal patch channels. The direct fix is to apply output encoding - in PHP, wrapping the medicine_name value with htmlspecialchars() before rendering it in any HTML context eliminates the CWE-79 root cause without functional side effects. As a compensating control, restrict access to the /ShowForm/create_medicine_name/main endpoint to administrator-role accounts only, removing low-privileged users' ability to submit medicine name values and collapsing the PR:L attack surface; this may affect workflow if clerks routinely create medicine entries. Additionally, deploying a Content Security Policy (CSP) response header that disallows inline scripts (script-src 'self') limits the blast radius of any successful XSS injection by blocking unauthorized script execution in the browser, though this requires testing for compatibility with the application's own inline JavaScript. The public proof-of-concept is documented at https://github.com/timeflies123/cve/issues/2 and the VulDB entry at https://vuldb.com/vuln/367522 for further technical detail.