Is there a public PoC exploit available for CVE-2026-7392?

Yes, a public proof-of-concept exploit is available for CVE-2026-7392. Prioritise patching immediately. EPSS: 0.0%.

Pharmacy Sales and Inventory System CVE-2026-7392

Q: What is the CVSS score of CVE-2026-7392?

CVE-2026-7392 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26264 LOW

SQL Injection (CWE-89)

2026-04-29 VulDB

PHP SQLi Pharmacy Sales And Inventory System Sourcecodester

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQL injection requires low-privilege auth (PR:L); partial C/I/A impact scoped entirely to the application database with no privilege escalation or scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:40 vuln.today

PoC Detected

Apr 29, 2026 - 21:16 vuln.today

Public exploit code

Severity Changed

Apr 29, 2026 - 17:22 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 17:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Apr 29, 2026 - 17:15 euvd

EUVD-2026-26264

CVE Published

Apr 29, 2026 - 16:45 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function delete_supplier of the file /ajax.php?action=delete_supplier. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 enables low-privilege authenticated attackers to manipulate backend database queries via the unsanitized id parameter in the delete_supplier function at /ajax.php?action=delete_supplier. Exploitation yields partial confidentiality, integrity, and availability impact against the application database, consistent with the CVSS 4.0 VC:L/VI:L/VA:L scope. A public proof-of-concept is available on GitHub, though EPSS at 0.03% (8th percentile) and SSVC's 'not automatable' designation indicate negligible real-world exploitation pressure at this time; no CISA KEV listing exists.

Technical ContextAI

The affected application is a PHP-based pharmacy management web application distributed by SourceCodester (cpe:2.3:a:sourcecodester:pharmacy_sales_and_inventory_system:*:*:*:*:*:*:*:*), with version 1.0 as the sole confirmed affected release. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the delete_supplier function in /ajax.php interpolates the HTTP-supplied id parameter directly into a SQL DELETE statement without parameterized queries or input sanitization. This allows an attacker to inject arbitrary SQL syntax, potentially expanding the query to read, modify, or delete records across the database beyond the intended single-supplier deletion. The PHP tag confirms server-side scripting in the application stack; no framework-level ORM or query abstraction appears to be in use for this endpoint.

RemediationAI

No vendor-released patch has been identified for Pharmacy Sales and Inventory System 1.0 at time of analysis; the fix status should be tracked at https://vuldb.com/vuln/360117 and the SourceCodester product page at https://www.sourcecodester.com/. As an immediate compensating control, restrict access to the /ajax.php endpoint to authenticated, role-appropriate users only and validate that session controls prevent horizontal privilege escalation to the delete_supplier action. Deploying a web application firewall rule to reject SQL metacharacters (single quotes, UNION, comment sequences) in the id parameter is effective but carries a false-positive risk on malformed legitimate numeric IDs if not tuned to an integer allowlist. The most conservative interim measure is to disable or remove the supplier deletion feature from the application until a patched version is available, accepting the trade-off of reduced administrative functionality. Source-code remediation involves replacing direct SQL string concatenation with PDO prepared statements targeting the affected function in /ajax.php.