Is there a public PoC exploit available for CVE-2026-10255?

Yes, a public proof-of-concept exploit is available for CVE-2026-10255. Prioritise patching immediately. EPSS: 0.0%.

Pharmacy Sales and Inventory System CVE-2026-10255

Q: What is the CVSS score of CVE-2026-10255?

CVE-2026-10255 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33634 MEDIUM

Improper Access Control (CWE-284)

2026-06-01 VulDB

GHSA-3wvj-gh52-3xp8

PHP Authentication Bypass Pharmacy Sales And Inventory System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 01, 2026 - 13:22 NVD

5.3 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 13:17 vuln.today

DescriptionCVE.org

A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is the function sell_statement of the file application/controllers/ShowForm.php. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Unauthenticated remote information disclosure in SourceCodester Pharmacy Sales and Inventory System 1.0 allows network-based attackers to bypass access controls and read sensitive sales statement data via the sell_statement function in application/controllers/ShowForm.php. The CVSS vector confirms PR:N (no authentication required) with low access complexity, and a proof-of-concept exploit has been publicly disclosed via GitHub. No KEV listing at time of analysis, but the combination of unauthenticated network access and available exploit code elevates practical risk beyond the moderate CVSS 5.3 score alone.

Technical ContextAI

The affected system is a PHP-based web application (SourceCodester Pharmacy Sales and Inventory System, CPE: cpe:2.3:a:sourcecodester:pharmacy_sales_and_inventory_system:*:*:*:*:*:*:*:*) using a standard MVC controller architecture. The vulnerable component is the sell_statement function within application/controllers/ShowForm.php, a controller endpoint responsible for rendering sales statement data. The root cause is CWE-284 (Improper Access Control): the function does not enforce authentication or authorization checks before serving sensitive records, consistent with the 'Authentication Bypass' tag assigned to this CVE. This class of flaw typically arises when PHP controller endpoints are reachable via direct URL invocation without a session or role validation gate - meaning the framework routing exposes the function to unauthenticated callers.

RemediationAI

No vendor-released patch has been identified at time of analysis; the NVD CPE uses a wildcard version with no fixed release noted. As an immediate compensating control, restrict direct HTTP access to the application/controllers/ShowForm.php endpoint at the web server level (e.g., Apache .htaccess or nginx location block) so that unauthenticated requests to that controller path return 403 - note this may break legitimate UI flows that invoke sell_statement and will require regression testing. A second control is to add a PHP session authentication check at the top of the sell_statement function (e.g., verify $_SESSION['user_id'] is set before executing logic), which is a targeted code fix with no expected side effects if session management is already functional elsewhere in the application. If the application is internet-facing, deploying a WAF rule to block unauthenticated requests to ShowForm.php is an additional layer. Refer to VulDB entry https://vuldb.com/vuln/367533 for any updated patch status from the reporter.