Which versions of Pharmacy Sales and Inventory System are affected by CVE-2026-7126?

SourceCodester Pharmacy Sales and Inventory System version 1.0 contains a critical SQL injection vulnerability in the category management function that allows unauthenticated remote attackers to…

Is there a public PoC exploit available for CVE-2026-7126?

Yes, a public proof-of-concept exploit is available for CVE-2026-7126. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7126?

Within 24 hours: inventory all instances of SourceCodester Pharmacy Sales and Inventory System 1.0 across your environment and isolate affected systems from internet-facing access; verify current backups of pharmacy databases are immutable and offline. Within 7 days: evaluate migration to alternative pharmacy management software with active vendor support, or implement network-level access controls restricting /ajax.php endpoints to authorized administrative networks only; conduct database integrity audit for signs of unauthorized queries. Within 30 days: complete migration to patched or alternative pharmacy system; if retention is necessary pending replacement, deploy Web Application Firewall rules to block SQL injection patterns in the ID parameter of /ajax.php requests.

Pharmacy Sales and Inventory System CVE-2026-7126

Q: What is the CVSS score of CVE-2026-7126?

CVE-2026-7126 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25850 MEDIUM

SQL Injection (CWE-89)

2026-04-27 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 27, 2026 - 14:22 NVD

HIGH MEDIUM

CVSS changed

Apr 27, 2026 - 14:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 27, 2026 - 14:00 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 13:30 euvd

EUVD-2026-25850

Analysis Generated

Apr 27, 2026 - 13:30 vuln.today

CVE Published

Apr 27, 2026 - 13:00 nvd

MEDIUM 5.5

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /ajax.php?action=save_category. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in /ajax.php?action=save_category. Public exploit code exists on GitHub (y1shiny1shin/vuldb-project), enabling immediate weaponization against unpatched systems. CVSS 7.3 reflects potential for confidentiality, integrity, and availability compromise through database manipulation. No remediation release identified at time of analysis.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based web application. The affected component is /ajax.php with action=save_category, likely handling category management operations in the pharmacy inventory system. The ID parameter accepts user-supplied input without proper sanitization or parameterized queries, allowing injection of malicious SQL commands. The vulnerability exists in SourceCodester Pharmacy Sales and Inventory System version 1.0 (CPE 2.3:a:sourcecodester:pharmacy_sales_and_inventory_system:*). SQL injection occurs when untrusted data is concatenated directly into SQL queries rather than using prepared statements or input validation, enabling attackers to break out of the intended query structure and execute arbitrary database operations.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations running SourceCodester Pharmacy Sales and Inventory System 1.0 should implement compensating controls immediately. Primary mitigation: apply input validation and parameterized queries to /ajax.php save_category handler, specifically sanitizing the ID parameter using prepared statements (e.g., PDO with bound parameters in PHP). If source modification is not feasible, deploy web application firewall rules to block SQL metacharacters in ID parameter (', --, ;, UNION, SELECT keywords), though this provides incomplete protection against advanced injection techniques and may break legitimate functionality requiring special characters. Alternative: restrict access to /ajax.php to authenticated admin sessions only via web server configuration, converting this from unauthenticated remote to authenticated remote attack (still vulnerable but reduces attack surface). Consider replacing this application with actively maintained pharmacy management software with established security track record, as the lack of vendor security response suggests no future patches. VulDB references available at vuldb.com/vuln/359725 and exploit details at github.com/y1shiny1shin/vuldb-project/issues/2.