SourceCodester Pharmacy Sales and Inventory System CVE-2026-7269

Q: What is the CVSS score of CVE-2026-7269?

CVE-2026-7269 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26041 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-28 cna@vuldb.com

PHP XSS

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

4.8 (MEDIUM) 1.9 (LOW)

Analysis Generated

Apr 28, 2026 - 13:31 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 13:22 euvd

EUVD-2026-26041

Analysis Generated

Apr 28, 2026 - 13:22 vuln.today

CVE Published

Apr 28, 2026 - 13:19 nvd

LOW 1.9

DescriptionCVE.org

A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected is an unknown function of the file /index.php?page=product. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

AnalysisAI

Reflected cross-site scripting in SourceCodester Pharmacy Sales and Inventory System 1.0 allows authenticated remote attackers to inject malicious scripts via the ID parameter in /index.php?page=product, requiring user interaction to trigger payload execution. CVSS 4.8 with public exploit code availability (E:P) indicates low immediate risk despite network accessibility, constrained by high privilege requirement (PR:H) and user interaction dependency (UI:P).

Technical ContextAI

The vulnerability is a Reflected XSS (CWE-79) occurring in a PHP-based inventory management application. The /index.php?page=product endpoint fails to properly sanitize or encode the ID parameter before rendering it in HTTP responses. This allows an attacker to inject arbitrary HTML and JavaScript into the response, which executes in the victim's browser within the security context of the vulnerable application. The affected product is a server-side PHP application managing pharmacy inventory and sales operations, commonly deployed as a web application accessible over HTTP/HTTPS.

RemediationAI

Primary fix: Contact SourceCodester for a patched version or security update, as no specific patch version number is documented in available references. Immediate workaround: implement input validation and output encoding on the ID parameter in /index.php?page=product by applying HTML entity encoding (e.g., htmlspecialchars() or similar PHP sanitization functions) to any user-supplied input before rendering in HTTP responses. Additional controls: restrict access to /index.php?page=product to authorized administrative users via network access controls or web application firewall rules; implement Content Security Policy (CSP) headers to restrict inline script execution, limiting blast radius if encoding is bypassed. Deployment consideration: if patched version is unavailable, apply WAF rules blocking script tags and event handlers in the ID parameter as a temporary measure, accepting that sophisticated encoding bypasses may still succeed.