Is there a public PoC exploit available for EUVD-2026-33621?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33621. Prioritise patching immediately. EPSS: 0.0%.

Pharmacy Sales and Inventory System EUVD-2026-33621

Q: What is the CVSS score of EUVD-2026-33621?

EUVD-2026-33621 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-10247 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-01 VulDB

GHSA-g9gc-69gg-376j

XSS Pharmacy Sales And Inventory System Sourcecodester

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 01, 2026 - 11:22 NVD

3.5 (LOW) 2.0 (LOW)

Analysis Generated

Jun 01, 2026 - 11:21 vuln.today

DescriptionCVE.org

A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. This vulnerability affects the function create_generic_name of the file /ShowForm/create_generic_name/main. The manipulation of the argument generic_name results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used.

AnalysisAI

Stored or reflected cross-site scripting in SourceCodester Pharmacy Sales and Inventory System 1.0 allows authenticated remote attackers to inject malicious scripts via the generic_name parameter of the create_generic_name function at /ShowForm/create_generic_name/main. Exploitation requires victim user interaction (UI:R) to trigger script execution, limiting impact to low integrity loss with no confidentiality or availability impact (CVSS 3.5). Publicly available exploit code exists per the GitHub issue tracker reference, though this CVE is not listed in the CISA KEV catalog and EPSS data was not provided in source intelligence.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the application fails to sanitize or encode user-supplied input before rendering it in a browser context. The vulnerable endpoint is the create_generic_name PHP function within /ShowForm/create_generic_name/main, a form handler in a SourceCodester-published PHP-based pharmacy management web application. The CPE cpe:2.3:a:sourcecodester:pharmacy_sales_and_inventory_system:*:*:*:*:*:*:*:* covers all sub-versions of the 1.0 release. SourceCodester applications are open-source academic/demo projects commonly deployed in educational or small-business settings, meaning they typically receive little security maintenance and may lack output encoding frameworks.

RemediationAI

No vendor-released patch has been identified at time of analysis - VulDB (https://vuldb.com/cve/CVE-2026-10247) and the referenced GitHub issue (https://github.com/timeflies123/cve/issues/5) confirm the finding but no fix version is documented. As SourceCodester publishes open-source PHP code, operators with development capability should apply output encoding to the generic_name parameter before rendering, specifically using htmlspecialchars() or equivalent framework escaping in the create_generic_name view. As a compensating control, restrict access to the /ShowForm/create_generic_name/main endpoint to trusted administrative roles only, reducing the pool of authenticated users who can supply input - note this does not eliminate the vulnerability but narrows the attack surface. Web application firewall rules blocking script-tag injection patterns on the generic_name parameter can further reduce risk, though WAF bypass is trivial for skilled attackers. Content-Security-Policy headers disabling inline scripts would mitigate XSS execution impact even if injection succeeds.