CVE-2026-7281
Cross-Site Scripting in SourceCodester Pharmacy Supplier Function
Publication date: 2026-04-28
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sourcecodester | pharmacy_sales_and_inventory_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a Cross-Site Scripting (XSS) flaw that allows attackers to steal cookies, session tokens, or other sensitive information, and perform unauthorized actions on behalf of victims.
Such unauthorized access and potential data theft can lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.
Failure to remediate this vulnerability could result in non-compliance with these standards due to the risk of data exposure and compromise of user privacy.
Can you explain this vulnerability to me?
CVE-2026-7281 is a Cross-Site Scripting (XSS) vulnerability found in the SourceCodester Pharmacy Sales and Inventory System version 1.0, specifically in the file /index.php?page=supplier.
The vulnerability arises because the 'name' parameter is improperly handled: user input is directly output to the web page without proper encoding or filtering.
This flaw allows attackers to inject malicious JavaScript code that executes in the victim's browser, potentially leading to unauthorized actions.
How can this vulnerability impact me? :
Exploitation of this vulnerability can have several impacts:
- Attackers can steal cookies, session tokens, or other sensitive information.
- They can perform unauthorized actions on behalf of the victim.
- Attackers may deface web pages or redirect users to malicious sites.
- It can potentially lead to control over the victim's browser.
Notably, exploitation does not require any login or authorization, making it easier for attackers to leverage.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the supplier page of the Pharmacy Sales and Inventory System for improper handling of the 'name' parameter. Specifically, injecting a script payload into the 'name' parameter and observing if it executes can confirm the presence of the Cross-Site Scripting (XSS) flaw.
- Use a web browser or tools like curl or wget to send a request with a script payload, for example: curl "http://target/index.php?page=supplier&name=<script>prompt(/xss/);</script>"
- Observe the response in the browser or the HTTP response to see if the script executes or is reflected unencoded in the page.
- Use web vulnerability scanners that support XSS detection to automate testing on the affected URL.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing proper output encoding and input validation to prevent malicious scripts from executing.
- Apply output encoding on the 'name' parameter to ensure user input is treated as text, not executable code.
- Enforce strict input validation and filtering to reject or escape script tags and event handlers.
- Implement a Content Security Policy (CSP) to restrict the sources of executable scripts.
- Set HttpOnly and Secure flags on cookies to protect against theft via XSS.
- Conduct regular security audits to identify and fix XSS and other vulnerabilities promptly.