SourceCodester Pharmacy Sales and Inventory System CVE-2026-7128

Q: What is the CVSS score of CVE-2026-7128?

CVE-2026-7128 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25852 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-04-27 cna@vuldb.com

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Apr 27, 2026 - 14:33 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 14:22 euvd

EUVD-2026-25852

Analysis Generated

Apr 27, 2026 - 14:22 vuln.today

CVE Published

Apr 27, 2026 - 14:16 nvd

MEDIUM 5.5

DescriptionCVE.org

A security vulnerability has been detected in SourceCodester Pharmacy Sales and Inventory System 1.0. This issue affects some unknown processing of the file /ajax.php?action=save_type. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter in /ajax.php?action=save_type, enabling arbitrary SQL query execution with confidentiality and integrity impact. Publicly disclosed exploit code is available, significantly increasing real-world risk despite the moderate CVSS score of 6.9.

Technical ContextAI

The vulnerability exists in a PHP-based web application endpoint that processes AJAX requests. The /ajax.php file with action=save_type parameter fails to properly sanitize or parameterize the ID argument before incorporating it into SQL queries, violating CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). This is a classical SQL injection flaw in a file upload/inventory management system where user input flows directly into database operations without prepared statements or input validation.

RemediationAI

Immediate action: upgrade to a patched version of SourceCodester Pharmacy Sales and Inventory System if available from https://www.sourcecodester.com/. If no patch is available, implement the following compensating controls: (1) Disable or restrict network access to /ajax.php?action=save_type endpoint using Web Application Firewall (WAF) rules or web server configuration, permitting only trusted internal IP ranges - this eliminates remote exploitation but may impact legitimate inventory operations; (2) Apply strict input validation on the ID parameter to allow only numeric values using regex patterns (e.g., ^[0-9]+$) at the application or WAF layer; (3) Implement parameterized SQL queries (prepared statements) in the PHP code if source is accessible; (4) Deploy SQL injection detection signatures in intrusion prevention systems, looking for common SQLi payloads in the ID parameter. Immediate verification with SourceCodester support is critical given the public exploit availability.