SourceCodester Pharmacy System CVE-2026-7129

Q: What is the CVSS score of CVE-2026-7129?

CVE-2026-7129 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25853 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-27 cna@vuldb.com

PHP XSS

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Apr 27, 2026 - 14:33 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 14:22 euvd

EUVD-2026-25853

Analysis Generated

Apr 27, 2026 - 14:22 vuln.today

CVE Published

Apr 27, 2026 - 14:16 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function of the file /index.php?page=categories. Performing a manipulation of the argument ID results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.

AnalysisAI

Reflected cross-site scripting (XSS) in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote attackers to inject malicious scripts via the ID parameter in /index.php?page=categories. The vulnerability requires user interaction (clicking a crafted link) but has publicly available exploit code and a low CVSS score (5.3) reflecting limited impact scope, with only low integrity consequences to the victim's session or data.

Technical ContextAI

The vulnerability is a reflected XSS flaw (CWE-79) in a PHP-based web application. The /index.php?page=categories endpoint fails to properly sanitize or encode user-supplied input in the ID parameter before rendering it in the HTTP response. When a victim visits a malicious URL containing JavaScript payload in the ID parameter, the unfiltered input is rendered directly in the browser context, allowing execution of arbitrary scripts within the victim's session. This is a classic input validation and output encoding failure in server-side PHP code, likely missing htmlspecialchars(), urlencode(), or similar sanitization functions.

RemediationAI

Update SourceCodester Pharmacy Sales and Inventory System to a patched version released by SourceCodester following this disclosure. If a patched version is not immediately available, implement HTML entity encoding on all user-supplied input before rendering in HTML context-specifically, apply PHP's htmlspecialchars() function to the ID parameter with ENT_QUOTES flag in /index.php around the categories page rendering. Additionally, implement Content Security Policy (CSP) headers (e.g., 'default-src self; script-src self') to mitigate reflected XSS even if input encoding is missed. Do NOT rely on blacklist-based sanitization (e.g., stripping '<' and '>'), as bypass techniques exist. Test the fix by attempting to inject <script>alert('XSS')</script> into the ID parameter and verifying no execution occurs. Contact SourceCodester support at www.sourcecodester.com for official patched releases or interim guidance.