Is there a public PoC exploit available for CVE-2026-7391?

Yes, a public proof-of-concept exploit is available for CVE-2026-7391. Prioritise patching immediately. EPSS: 0.0%.

Pharmacy Sales and Inventory System CVE-2026-7391

Q: What is the CVSS score of CVE-2026-7391?

CVE-2026-7391 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26257 LOW

SQL Injection (CWE-89)

2026-04-29 VulDB

PHP SQLi Pharmacy Sales And Inventory System Sourcecodester

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable endpoint requires low-privilege authentication (PR:L); limited C/I/A impact reflects application-scoped database access with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:47 vuln.today

PoC Detected

Apr 29, 2026 - 21:16 vuln.today

Public exploit code

Severity Changed

Apr 29, 2026 - 17:22 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 17:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Apr 29, 2026 - 17:00 euvd

EUVD-2026-26257

CVE Published

Apr 29, 2026 - 16:15 nvd

LOW 2.1

DescriptionCVE.org

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function save_supplier of the file /ajax.php?action=save_supplier. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

AnalysisAI

SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 permits a low-privileged authenticated remote attacker to manipulate the ID parameter in the save_supplier function at /ajax.php?action=save_supplier, enabling arbitrary SQL command execution against the backend database. A publicly available proof-of-concept exploit has been published on GitHub, though EPSS probability is extremely low at 0.03% (8th percentile) and SSVC rates both automatability and technical impact as limited, reflecting the narrow real-world deployment footprint of this educational PHP application. No active exploitation has been confirmed by CISA KEV.

Technical ContextAI

The vulnerability resides in the PHP-based SourceCodester Pharmacy Sales and Inventory System 1.0, a freely distributed educational web application available at sourcecodester.com targeted at students and developers learning PHP. The root cause is CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command): the save_supplier function in /ajax.php incorporates the user-supplied ID argument directly into SQL query construction without parameterization or sanitization, allowing injection of arbitrary SQL syntax. The CPE identifier cpe:2.3:a:sourcecodester:pharmacy_sales_and_inventory_system:*:*:*:*:*:*:*:* covers the product; only version 1.0 is identified as affected per EUVD-2026-26257. The application connects to a relational SQL backend with permissions scoped to its own database, bounding the blast radius of any successful injection.

RemediationAI

No vendor-released patch has been identified at time of analysis. Because SourceCodester distributes editable PHP source code, remediation requires direct code modification: developers must refactor the save_supplier function in /ajax.php to use parameterized prepared statements (e.g., PDO with bound parameters) instead of raw string concatenation, and validate that the ID parameter accepts only expected integer values before any database interaction. Organizations running this application in any network-accessible capacity should immediately restrict endpoint access to authenticated, trusted internal users, and consider taking the application offline until the code is patched - the trade-off being service disruption versus continued exposure to an authenticated SQLi with a public POC. Reference the VulDB advisory at https://vuldb.com/vuln/360116 and the POC details at https://github.com/microwaveabi/vul/issues/3 to inform the targeted fix.