CVE-2026-85207
Received Received - Intake

Online Medicine Delivery System XSS via orderdetails Parameter

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulDB

Description
A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-04
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85207
EUVD
EUVD-2026-70700

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
itsourcecode online_medicine_delivery_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in the Online Medicine Delivery System 1.0. It exists in the /index.php?q=orderdetails file where manipulation of the 'location' argument allows an attacker to inject malicious scripts. The attack can be executed remotely and an exploit is publicly available.

Detection Guidance

This vulnerability involves a reflected cross-site scripting (XSS) flaw in the Online Medicine Delivery System via the /index.php?q=orderdetails parameter. To detect it, inspect web traffic for requests to this endpoint with unusual or malicious input in the 'location' argument. Use tools like curl to send test payloads such as <script>alert(1)</script> in the location parameter and observe if the script executes in the response.

Impact Analysis

This XSS vulnerability could allow attackers to steal user session cookies, redirect users to malicious sites, or perform actions on behalf of users. It may expose sensitive data like medical information if exploited in a healthcare context.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (healthcare privacy) if exploited to access or leak protected health information. Organizations may face fines or penalties for failing to protect sensitive user data.

Mitigation Strategies

Immediately update the Online Medicine Delivery System to the latest patched version. If no patch is available, implement input validation and output encoding for the 'location' parameter in /index.php?q=orderdetails. Use web application firewalls to filter malicious scripts. Disable or restrict access to the vulnerable endpoint if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85207. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart