Is there a public PoC exploit available for CVE-2026-10248?

Yes, a public proof-of-concept exploit is available for CVE-2026-10248. Prioritise patching immediately. EPSS: 0.1%.

Pharmacy Sales and Inventory System CVE-2026-10248

Q: What is the CVSS score of CVE-2026-10248?

CVE-2026-10248 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-33623 LOW

Improper Neutralization of Formula Elements in a CSV File (CWE-1236)

2026-06-01 VulDB

GHSA-hpq4-4cqf-mcg8

Information Disclosure Pharmacy Sales And Inventory System Sourcecodester

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 11:22 NVD

MEDIUM LOW

CVSS changed

Jun 01, 2026 - 11:22 NVD

4.7 (MEDIUM) 2.0 (LOW)

Analysis Generated

Jun 01, 2026 - 11:22 vuln.today

DescriptionCVE.org

A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System up to 1.0. This issue affects the function create_supplier of the file /Export_csv/export of the component Supplier Creation Interface. This manipulation of the argument Address/Company Name causes csv injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

CSV injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows high-privileged remote attackers to embed malicious spreadsheet formula payloads via the Address and Company Name fields in the Supplier Creation Interface, which are then written unsanitized to exported CSV files. When downstream staff open the exported file in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the injected formulas execute in that client application's context, enabling information disclosure, data manipulation, or further client-side exploitation. A publicly available proof-of-concept exists (GitHub), though no active exploitation has been confirmed and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

CWE-1236 (Improper Neutralization of Formula Elements in a CSV File) describes a class of injection vulnerabilities where user-supplied input containing spreadsheet formula trigger characters - typically leading '=', '+', '-', or '@' - is written into CSV output without sanitization or proper quoting. In this case, the vulnerable sink is the create_supplier function within the /Export_csv/export endpoint of the Supplier Creation Interface. The CPE string (cpe:2.3:a:sourcecodester:pharmacy_sales_and_inventory_system:*:*:*:*:*:*:*:*) confirms the affected software is SourceCodester's PHP-based Pharmacy Sales and Inventory System through version 1.0. The attack is not server-side code execution - it is a client-side formula injection that activates when a human operator exports and opens the CSV in a spreadsheet application, which then interprets attacker-controlled content as executable formula logic.

RemediationAI

No vendor-released patch has been identified at time of analysis - the remediation level in the CVSS temporal vector is listed as Unknown (RL:X), and no patched version is referenced in any available advisory. Organizations running this software should apply the following compensating controls: (1) Sanitize user input at the point of entry by stripping or rejecting leading formula trigger characters (=, +, -, @) from the Address and Company Name fields in the Supplier Creation Interface - note this may reject some legitimate address formats starting with '+' country codes and should be communicated to users. (2) Implement server-side CSV output encoding by prefixing all cell values with a tab character or wrapping them in double quotes to prevent formula interpretation - this is the recommended OWASP defense and has no functional side effects on data fidelity. (3) Restrict access to the CSV export feature (/Export_csv/export) to the minimum necessary personnel, reducing the pool of potential victims who might open a maliciously crafted export. (4) Educate users to open exported CSV files in protected view or to use text-based viewers when handling untrusted exports. VulDB tracking is available at https://vuldb.com/vuln/367526.