Cross Site Scripting Vulnerability in SourceCodester Pharmacy Sales and Inventory System
CVE-2026-10246

5.1MEDIUM

Key Information:

Vendor: Sourcecodester
Status: Pharmacy Sales And Inventory System
Vendor: CVE Published:; 1 June 2026

🔔 Create Sourcecodester Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-10246?

A cross-site scripting (XSS) vulnerability exists in the SourceCodester Pharmacy Sales and Inventory System due to improper handling of user-supplied input in the create_medicine_presentation function. This flaw can be exploited by an attacker to inject malicious scripts into the system, enabling the execution of arbitrary JavaScript in the context of other users' sessions. The manipulation involves the 'medicine_presentation' argument within the /ShowForm/create_medicine_presentation/main file. As a result, attackers may execute payloads that hijack sessions, redirect users to malicious websites, or harvest sensitive information. The threat is compounded by the potential for remote exploitation, making it critical for users of this system to assess and mitigate the risks associated with this vulnerability.

Affected Version(s)

Pharmacy Sales and Inventory System 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-10246 - Proof of Concept