Is there a public PoC exploit available for EUVD-2026-28523?

Yes, a public proof-of-concept exploit is available for EUVD-2026-28523. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester Pharmacy Sales and Inventory System EUVD-2026-28523

Q: What is the CVSS score of EUVD-2026-28523?

EUVD-2026-28523 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-8136 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-08 VulDB

GHSA-3h5f-583p-w5vj

XSS PHP

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 04:35 vuln.today

CVSS changed

May 08, 2026 - 04:22 NVD

2.4 (LOW) 1.9 (LOW)

CVE Published

May 08, 2026 - 03:45 nvd

LOW 1.9

DescriptionCVE.org

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /index.php?page=users. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used.

AnalysisAI

Cross-site scripting (XSS) in SourceCodester Pharmacy Sales and Inventory System 1.0 allows high-privileged users with user interaction to inject malicious scripts via the Name parameter in /index.php?page=users, affecting application integrity with low severity. The vulnerability requires administrative privileges and user interaction to exploit, limiting real-world impact despite public exploit availability.

Technical ContextAI

The vulnerability is a reflected or stored cross-site scripting (CWE-79) flaw in a PHP-based web application. The attack vector targets the user management interface at /index.php?page=users, specifically the Name parameter, which accepts unsanitized input that is rendered in the browser without proper output encoding or input validation. The PHP application fails to implement context-appropriate escaping mechanisms (htmlspecialchars, CSP headers, or input filtering) when processing and displaying the Name field, allowing attackers to inject arbitrary HTML and JavaScript payloads that execute in the victim's browser context.

RemediationAI

Immediate mitigation requires upgrading to a patched version if available from SourceCodester; vendor patch status not confirmed from available data. As a compensating control, implement output encoding by applying htmlspecialchars() or equivalent context-aware escaping (e.g., HTML entity encoding) to all user-supplied input before rendering in HTML context, specifically the Name parameter in /index.php?page=users. Additionally, implement Content Security Policy (CSP) headers with script-src 'self' to prevent inline script execution, reducing XSS payload effectiveness even if injection succeeds. Restrict administrative access to the /index.php?page=users endpoint to trusted internal networks via firewall or application-level access controls, limiting exposure to legitimate administrative users only. Conduct code review of user input handling across the application to identify similar XSS vulnerabilities in other parameters.