Pharmacy Sales and Inventory System CVE-2026-7390

Q: What is the CVSS score of CVE-2026-7390?

CVE-2026-7390 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26253 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-29 cna@vuldb.com

PHP XSS

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

XSS requires low-privilege authentication (PR:L), victim interaction to trigger rendering (UI:R), and scope change (S:C) as script executes in another user's browser.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:41 vuln.today

EUVD ID Assigned

Apr 29, 2026 - 16:22 euvd

EUVD-2026-26253

CVE Published

Apr 29, 2026 - 16:16 nvd

LOW 2.0

DescriptionCVE.org

A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. The impacted element is the function Customer of the file /index.php?page=customer. The manipulation of the argument Name results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.

AnalysisAI

Stored or reflected cross-site scripting in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote low-privileged attackers to inject malicious JavaScript via the Name parameter of the Customer function at /index.php?page=customer. A public proof-of-concept exploit is confirmed via GitHub and VulDB, but the CVSS 4.0 score of 2.0 and EPSS of 0.03% (9th percentile) reflect the constrained exploitation conditions: authentication and victim interaction are both required. No KEV listing indicates no confirmed active exploitation at time of analysis.

Technical ContextAI

The affected application is a PHP-based pharmacy management system distributed by SourceCodester, a platform known for publishing tutorial and demo-grade source code projects. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) identifies the root cause as failure to sanitize or encode user-supplied input before rendering it in the browser. Specifically, the Name argument passed to the Customer function at the /index.php?page=customer endpoint is not properly escaped, allowing injection of arbitrary HTML or JavaScript. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms network delivery with no attack complexity, but low-privilege authentication and passive victim interaction are required, consistent with a stored or DOM-rendered XSS requiring a second user to view the injected content.

RemediationAI

No vendor-released patch has been identified at time of analysis; no fix version or security advisory is referenced in the available data from SourceCodester or NVD. Operators should apply output encoding (e.g., htmlspecialchars() in PHP) to all user-supplied fields rendered in the browser, particularly the Name parameter in the Customer function, as an in-code mitigation. Deploying a Content Security Policy (CSP) header that restricts inline script execution provides a meaningful compensating control, though it may require testing against application functionality. Restricting access to the Customer management page to the minimum necessary user roles reduces attack surface. The GitHub issue at https://github.com/microwaveabi/vul/issues/4 and VulDB entry at https://vuldb.com/vuln/360115 contain additional technical detail. Given the tutorial/demo nature of this software, the most effective remediation is removing the application from production exposure entirely if it is not required.