CVE-2026-10244
Cross-Site Scripting in Pharmacy Sales and Inventory System
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sourcecodester | pharmacy_sales_and_inventory_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a Cross-Site Scripting (XSS) issue that allows attackers to execute arbitrary scripts in a victim's browser, potentially stealing sensitive information such as cookies or session tokens and performing unauthorized actions.
Such unauthorized access and potential data theft can lead to violations of privacy and data protection requirements mandated by standards like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.
Therefore, if exploited, this vulnerability could compromise compliance with these regulations by exposing sensitive user data and failing to maintain adequate security controls.
Can you explain this vulnerability to me?
The CVE-2026-10244 vulnerability is a Cross-Site Scripting (XSS) issue found in the Pharmacy Sales and Inventory System version 1.0. It occurs in the function create_medicine_name within the file /ShowForm/create_medicine_name/main. The vulnerability arises because the 'medicine_name' parameter is not properly validated or encoded before being displayed on the web page.
Attackers can exploit this flaw by injecting malicious script code through the 'medicine_name' parameter, which then executes arbitrary scripts in the victim's browser.
How can this vulnerability impact me? :
Exploitation of this vulnerability can allow attackers to execute arbitrary scripts in users' browsers, which may lead to several harmful consequences.
- Stealing sensitive information such as cookies or session tokens.
- Performing unauthorized actions on behalf of the user.
- Defacing web pages.
- Redirecting users to malicious websites.
The vulnerability requires no authentication to exploit, increasing the risk to user privacy and system security.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the 'medicine_name' parameter in the '/ShowForm/create_medicine_name/main' endpoint for improper input validation and output encoding. You can attempt to inject typical XSS payloads such as <script>alert(1)</script> into the 'medicine_name' parameter and observe if the script executes in the browser.
For detection on the system or network, you can use web vulnerability scanners or manual curl commands to test the parameter.
- Example curl command to test the vulnerability: curl -G --data-urlencode "medicine_name=<script>alert(1)</script>" http://target-site/ShowForm/create_medicine_name/main
- Use browser developer tools to check if the injected script executes or appears unencoded in the page source.
- Automated scanners like OWASP ZAP or Burp Suite can be configured to test for reflected XSS on this parameter.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing proper output encoding and strict input validation on the 'medicine_name' parameter to prevent injection of malicious scripts.
- Sanitize and encode all user inputs before rendering them on web pages.
- Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts.
- Set secure and HttpOnly flags on cookies to protect session tokens from being accessed via client-side scripts.
- Conduct regular security audits and code reviews to identify and fix similar vulnerabilities.