PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10247 SourceCodester CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0, specifically within the `create_generic_name` function accessible via the `/ShowForm/create_generic_name/main` endpoint. The `generic_name` parameter lacks sufficient input sanitization, allowing remote attackers to inject malicious scripts. The vulnerability requires low privileges (PR:L) and user interaction (UI:P), with network-based attack vector (AV:N). The CVSS 4.0 vector indicates limited integrity impact (VI:L) with no confidentiality or availability impact. The exploit has been publicly disclosed, increasing practical risk despite the LOW severity score.

Vendor
SourceCodester
Product
Pharmacy Sales and Inventory System
CVSS
LOW 2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations running SourceCodester Pharmacy Sales and Inventory System 1.0; healthcare/pharmacy IT administrators; web application security teams managing PHP-based inventory systems; vulnerability management programs tracking public exploit disclosures

Technical summary

The vulnerability resides in the `create_generic_name` function of `/ShowForm/create_generic_name/main` in SourceCodester Pharmacy Sales and Inventory System 1.0. Insufficient sanitization of the `generic_name` parameter permits injection of executable scripts. Attack vector is network-based with low attack complexity, requiring authenticated low-privilege access and user interaction. CVSS 4.0 score: 2.0 (LOW). Public exploit availability elevates practical concern.

Defensive priority

medium

Recommended defensive actions

  • Apply input validation and output encoding for the generic_name parameter in the create_generic_name function, implementing allowlist-based sanitization for expected character sets
  • Implement Content Security Policy (CSP) headers to mitigate impact of potential XSS payloads
  • Review and sanitize all user-controllable parameters in /ShowForm/create_generic_name/main endpoint
  • Monitor for unauthorized access attempts or anomalous requests to the affected endpoint
  • Verify vendor attribution and apply official patches from SourceCodester when available; consider temporary access restrictions to the administrative function pending remediation

Evidence notes

Vulnerability identified in SourceCodester Pharmacy Sales and Inventory System 1.0. CNA-assigned weaknesses include CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code). Public exploit disclosure confirmed via GitHub issue reference. Vendor attribution marked as low confidence requiring review; 'Unknown Vendor' designation with Vuldb as reference domain candidate.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10247 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10247

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10247 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10247

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.