CVE-2026-8136
Cross-Site Scripting in Pharmacy Sales and Inventory System
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sourcecodester | pharmacy_sales_and_inventory_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-8136 is a Cross-Site Scripting (XSS) vulnerability found in the SourceCodester Pharmacy Sales and Inventory System 1.0. It exists in the '/index.php?page=users' file where the 'name' parameter is not properly validated or encoded. This flaw allows attackers to inject malicious scripts that execute in the browsers of users who visit the affected page.
How can this vulnerability impact me? :
This vulnerability can have several impacts including the theft of sensitive information such as cookies or session tokens, enabling attackers to hijack user sessions. It can also allow unauthorized actions on behalf of users, defacement of web pages, or redirection of users to malicious websites. The attack can be launched remotely and does not require the attacker to be logged in or authorized.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the 'name' parameter in the '/index.php?page=users' URL for Cross-Site Scripting (XSS) payloads. An example payload to test is <script>prompt(/xss/);</script>. If the payload executes in the browser, the system is vulnerable.
You can use tools like curl or a web browser to send requests with the malicious payload in the 'name' parameter and observe the response or browser behavior.
- curl "http://targetsite/index.php?page=users&name=<script>prompt(/xss/);</script>"
- Use a web proxy tool like Burp Suite or OWASP ZAP to inject the payload into the 'name' parameter and monitor the response.
If the injected script executes or appears unencoded in the response, it indicates the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing proper output encoding and strict input validation on the 'name' parameter to prevent malicious script injection.
- Apply output encoding to all user-supplied data before rendering it in the HTML page.
- Validate and sanitize input on the server side to reject or neutralize potentially dangerous characters or scripts.
- Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts.
- Set secure and HttpOnly flags on cookies to protect session tokens from being accessed via client-side scripts.
Additionally, conduct regular security audits to identify and fix similar vulnerabilities.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The Cross-Site Scripting (XSS) vulnerability in the Pharmacy Sales and Inventory System allows attackers to execute malicious scripts in users' browsers, potentially stealing sensitive information such as cookies or session tokens.
Such unauthorized access to sensitive data can lead to violations of data protection regulations like GDPR and HIPAA, which mandate the protection of personal and health information against unauthorized access and breaches.
Therefore, this vulnerability can negatively impact compliance with these standards by exposing sensitive user data and failing to ensure adequate security controls.