Is there a public PoC exploit available for CVE-2026-7282?

Yes, a public proof-of-concept exploit is available for CVE-2026-7282. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester Pharmacy Sales and Inventory System CVE-2026-7282

Q: What is the CVSS score of CVE-2026-7282?

CVE-2026-7282 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26056 LOW

SQL Injection (CWE-89)

2026-04-28 VulDB

PHP SQLi

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 28, 2026 - 15:22 NVD

4.7 (MEDIUM) 5.1 (MEDIUM)

Analysis Generated

Apr 28, 2026 - 15:00 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 14:30 euvd

EUVD-2026-26056

Analysis Generated

Apr 28, 2026 - 14:30 vuln.today

CVE Published

Apr 28, 2026 - 13:30 nvd

LOW 2.0

DescriptionCVE.org

A vulnerability was identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function delete_expired of the file /ajax.php?action=delete_expired. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows authenticated high-privilege attackers to manipulate the ID parameter in the delete_expired function via /ajax.php?action=delete_expired, enabling remote database query manipulation with confidentiality, integrity, and availability impact. Publicly available exploit code exists and the vulnerability has been documented by VulDB.

Technical ContextAI

The vulnerability exists in a PHP-based web application's AJAX endpoint that processes requests to delete expired records. The delete_expired function fails to properly sanitize or parameterize the ID argument before incorporating it into SQL queries, resulting in a classic SQL injection vulnerability (CWE-89). The attack vector is network-accessible via HTTP GET or POST requests to the /ajax.php endpoint. The vulnerability affects the SourceCodester Pharmacy Sales and Inventory System, a PHP application commonly deployed in healthcare and retail pharmacy environments.

RemediationAI

Upgrade to a patched version of SourceCodester Pharmacy Sales and Inventory System if available from the vendor at https://www.sourcecodester.com/. If no official patch is available, implement parameterized queries (prepared statements) in the delete_expired function to prevent SQL injection - specifically, ensure all database interactions use parameterized query syntax rather than string concatenation. As an immediate compensating control, restrict access to /ajax.php to users with administrative roles only through firewall rules or application-level access controls, and implement input validation on the ID parameter to accept only expected numeric formats (e.g., regular expression matching only digits). Monitor database activity for unexpected DELETE or SELECT queries originating from the web application. These controls reduce exploitability but do not eliminate the underlying code vulnerability.