Is there a public PoC exploit available for CVE-2026-7194?

Yes, a public proof-of-concept exploit is available for CVE-2026-7194. Prioritise patching immediately. EPSS: 0.0%.

Pharmacy Sales System CVE-2026-7194

Q: What is the CVSS score of CVE-2026-7194?

CVE-2026-7194 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

SQL Injection (CWE-89)

2026-04-27 VulDB

PHP SQLi Pharmacy Sales And Inventory System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable unauthenticated endpoint with low-complexity SQLi (AV:N, AC:L, PR:N, UI:N); partial data read/write impact only (C:L, I:L); no distinct availability impact identified from description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:26 vuln.today

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 27, 2026 - 23:22 NVD

HIGH MEDIUM

CVSS changed

Apr 27, 2026 - 23:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

CVE Published

Apr 27, 2026 - 22:45 nvd

MEDIUM 5.5

DescriptionCVE.org

A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=save_product. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 exposes the /ajax.php?action=save_product endpoint to unauthenticated remote attackers who can manipulate the id parameter to inject arbitrary SQL commands against the backend database. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is needed, and a public proof-of-concept exploit is available per VulDB and a referenced GitHub issue. Despite straightforward exploitability, the EPSS score of 0.03% (9th percentile) reflects the product's niche deployment footprint rather than any exploitation difficulty, and no CISA KEV listing has been confirmed.

Technical ContextAI

The affected product is a PHP-based web application (CPE: cpe:2.3:a:sourcecodester:pharmacy_sales_and_inventory_system:*:*:*:*:*:*:*:*) distributed by SourceCodester, typically backed by a MySQL database and commonly used in educational or small-business pharmacy contexts. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the AJAX handler at /ajax.php?action=save_product incorporates the user-supplied id parameter directly into a SQL query without sanitization or parameterization. PHP applications relying on direct string interpolation rather than PDO or MySQLi prepared statements are a well-known source of this vulnerability class. The endpoint's AJAX nature suggests it is called from the application's frontend product management interface, likely without session-scoped authorization checks.

RemediationAI

No vendor-released patch has been identified at time of analysis. The definitive fix requires the application developer to replace direct SQL string interpolation with parameterized queries using PHP's PDO or MySQLi prepared statements for the id parameter in /ajax.php. As an immediate compensating control, restrict access to the /ajax.php endpoint to authenticated and authorized sessions at the application or server level - for Apache, this can be enforced via Require valid-user in .htaccess or through a session check in the PHP logic; note this may break unauthenticated AJAX workflows if any exist. Deploying a Web Application Firewall (WAF) with SQLi detection rules targeting this endpoint can block exploit attempts but should not be treated as a permanent fix, as WAF bypass is possible. If product management functionality can be temporarily suspended, disabling or removing the save_product action entirely eliminates the attack surface with no side effects beyond loss of that feature. Advisory reference: https://vuldb.com/vuln/359798.