PatchSiren cyber security CVE debrief

CVE-2026-10247 SourceCodester CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0, specifically within the `create_generic_name` function accessible via the `/ShowForm/create_generic_name/main` endpoint. The `generic_name` parameter lacks sufficient input sanitization, allowing remote attackers to inject malicious scripts. The vulnerability requires low privileges (PR:L) and user interaction (UI:P), with network-based attack vector (AV:N). The CVSS 4.0 vector indicates limited integrity impact (VI:L) with no confidentiality or availability impact. The exploit has been publicly disclosed, increasing practical risk despite the LOW severity score.

Vendor: SourceCodester
Product: Pharmacy Sales and Inventory System
CVSS: LOW 2
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-01
Original CVE updated: 2026-06-01
Advisory published: 2026-06-01
Advisory updated: 2026-06-01

Who should care

Organizations running SourceCodester Pharmacy Sales and Inventory System 1.0; healthcare/pharmacy IT administrators; web application security teams managing PHP-based inventory systems; vulnerability management programs tracking public exploit disclosures

Technical summary

The vulnerability resides in the `create_generic_name` function of `/ShowForm/create_generic_name/main` in SourceCodester Pharmacy Sales and Inventory System 1.0. Insufficient sanitization of the `generic_name` parameter permits injection of executable scripts. Attack vector is network-based with low attack complexity, requiring authenticated low-privilege access and user interaction. CVSS 4.0 score: 2.0 (LOW). Public exploit availability elevates practical concern.

Defensive priority

medium

Recommended defensive actions

Apply input validation and output encoding for the generic_name parameter in the create_generic_name function, implementing allowlist-based sanitization for expected character sets
Implement Content Security Policy (CSP) headers to mitigate impact of potential XSS payloads
Review and sanitize all user-controllable parameters in /ShowForm/create_generic_name/main endpoint
Monitor for unauthorized access attempts or anomalous requests to the affected endpoint
Verify vendor attribution and apply official patches from SourceCodester when available; consider temporary access restrictions to the administrative function pending remediation

Evidence notes

Vulnerability identified in SourceCodester Pharmacy Sales and Inventory System 1.0. CNA-assigned weaknesses include CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code). Public exploit disclosure confirmed via GitHub issue reference. Vendor attribution marked as low confidence requiring review; 'Unknown Vendor' designation with Vuldb as reference domain candidate.

Official resources

public