Is there a public PoC exploit available for CVE-2026-7746?

Yes, a public proof-of-concept exploit is available for CVE-2026-7746. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester Web-based Pharmacy Product Management System CVE-2026-7746

Q: What is the CVSS score of CVE-2026-7746?

CVE-2026-7746 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26935 LOW

SQL Injection (CWE-89)

2026-05-04 VulDB

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 04, 2026 - 15:17 vuln.today

Public exploit code

Severity Changed

May 04, 2026 - 09:22 NVD

MEDIUM LOW

CVSS changed

May 04, 2026 - 09:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 04, 2026 - 09:15 vuln.today

EUVD ID Assigned

May 04, 2026 - 09:00 euvd

EUVD-2026-26935

Analysis Generated

May 04, 2026 - 09:00 vuln.today

CVE Published

May 04, 2026 - 08:00 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected is an unknown function of the file /product_expiry/edit-admin.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in SourceCodester Web-based Pharmacy Product Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /product_expiry/edit-admin.php, enabling unauthorized data access, modification, and deletion. The vulnerability has a publicly available exploit and CVSS 6.3 base score reflects moderate impact with low attack complexity; however, authentication is required, limiting exposure to users with valid credentials.

Technical ContextAI

The vulnerability exists in the PHP-based web application's product expiry management functionality. The /product_expiry/edit-admin.php endpoint fails to properly sanitize or parameterize the ID argument before incorporating it into SQL queries, violating secure coding practices for SQL construction (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). This is a classic SQL injection flaw where user-controlled input is directly concatenated into database queries, allowing attackers to break query syntax boundaries and inject malicious SQL commands. The affected product is identified via CPE as cpe:2.3:a:sourcecodester:web-based_pharmacy_product_management_system with wildcard version matching, suggesting the vulnerability may affect multiple versions or the vendor has not provided granular versioning data.

RemediationAI

Immediately upgrade or patch SourceCodester Web-based Pharmacy Product Management System to the latest vendor-released version; however, no specific patched version number is provided in available advisory data-contact the vendor at https://www.sourcecodester.com/ to obtain the fixed release. As an interim compensating control pending patch deployment, restrict database user accounts used by the web application to read-only permissions on non-sensitive pharmacy tables and revoke INSERT, UPDATE, DELETE privileges where possible to limit the scope of SQL injection impact (trade-off: may break legitimate product modifications until fully patched). Additionally, implement strict input validation on the ID parameter by enforcing numeric-only input using whitelisting (e.g., regex /^[0-9]+$/) and use parameterized SQL queries (prepared statements) in all PHP code-this requires code review and redeployment by the vendor. Network-level mitigation: restrict /product_expiry/edit-admin.php to authorized internal IP ranges only and disable anonymous/unauthenticated web access to the admin panel via web application firewall rules.