SourceCodester Pharmacy Sales and Inventory System CVE-2026-7130

Q: What is the CVSS score of CVE-2026-7130?

CVE-2026-7130 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25854 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-04-27 cna@vuldb.com

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Apr 27, 2026 - 14:33 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 14:22 euvd

EUVD-2026-25854

Analysis Generated

Apr 27, 2026 - 14:22 vuln.today

CVE Published

Apr 27, 2026 - 14:16 nvd

MEDIUM 5.5

DescriptionCVE.org

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete_category. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

AnalysisAI

SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter in /ajax.php?action=delete_category, enabling arbitrary SQL query execution with confidentiality and integrity impact. CVSS 6.9 reflects network accessibility and low privilege requirements; publicly available exploit code exists per description.

Technical ContextAI

The vulnerability resides in a PHP application's AJAX endpoint that processes category deletion requests. The /ajax.php file accepts an 'action' parameter set to 'delete_category' and fails to properly sanitize the 'ID' parameter before incorporating it into SQL queries. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) indicates the root cause is insufficient input validation or parameterized query implementation. The affected component likely constructs dynamic SQL statements by string concatenation without prepared statements or parameterized queries, a common vulnerability pattern in legacy PHP applications. No WAF or intrusion detection signatures are mentioned in available references.

RemediationAI

Immediate action: Update SourceCodester Pharmacy Sales and Inventory System to a patched version released after version 1.0 - vendor advisory should be consulted at www.sourcecodester.com for availability and version number. If no patched version is available from the vendor, implement immediate compensating controls: (1) Restrict network access to /ajax.php endpoint using Web Application Firewall (WAF) rules that validate ID parameter syntax (numeric-only) and block SQL metacharacters; (2) Disable or remove the delete_category AJAX action if not operationally required; (3) Apply parameterized query conversion in the application code if source code access is available - replace all string concatenation with prepared statements using vendor-provided database libraries. Each mitigation has trade-offs: WAF rules may cause false positives with legitimate requests; disabling features affects functionality; code modification requires developer resources and testing. Concurrently audit database access logs for SQL error patterns and suspicious query submissions.