CVE-2026-10244: SourceCodester Pharmacy Sales and Inventory System XSS Vulnerability

Technical summary

CVE-2026-10244 is a reflected/stored XSS vulnerability (CWE-79, CWE-94) in the create_medicine_name function of SourceCodester Pharmacy Sales and Inventory System 1.0. The vulnerable endpoint is /ShowForm/create_medicine_name/main. The medicine_name parameter is not properly sanitized or encoded before being rendered in the HTML response, allowing an authenticated attacker to inject arbitrary JavaScript. The CVSS v3.1 score of 3.5 (LOW) reflects that exploitation requires valid credentials (PR:L) and user interaction (UI:R), with impact limited to integrity (I:L) and no confidentiality or availability loss.

Business impact

Organizations deploying this pharmacy system are exposed to targeted attacks by internal users or compromised accounts. An attacker with valid credentials could deface medicine records, harvest session tokens from other staff members, or redirect pharmacy staff to malicious sites during critical inventory operations. While the attack surface is limited to authenticated users, the healthcare context amplifies reputational and compliance risks, especially if patient data is displayed alongside manipulated medicine entries.

Affected systems

SourceCodester Pharmacy Sales and Inventory System version 1.0 is affected. No patch version information is provided in available advisories; users should verify directly with the vendor or check the project repository for available updates or security patches.

Exploitability

Exploitation is feasible but requires two preconditions: valid login credentials and user interaction (victim must visit a crafted link or page containing the payload). The remote nature (AV:N) and low complexity (AC:L) make it easy to deliver once an attacker has authentication. Public exploit code is now available, reducing the barrier to entry for attackers with compromised credentials or insider threats.

Remediation

Immediately check with SourceCodester for a patched version or security update. In the interim, implement strong access controls limiting who can create or edit medicine entries, enforce Content Security Policy (CSP) headers to block inline script execution, and monitor for suspicious medicine_name submissions containing script tags or encoded payloads. Consider input validation and output encoding at the application level if patches are delayed.

Patch guidance

Contact SourceCodester or visit their project repository to determine if a patched version of the Pharmacy Sales and Inventory System is available. Apply any security update as soon as feasible. If no patch is currently available, request a timeline from the vendor and implement compensating controls (CSP, WAF rules) to reduce risk during the interim period.

Detection guidance

Monitor access logs for requests to /ShowForm/create_medicine_name/main with unusual characters in the medicine_name parameter, such as <, >, script, onerror, onclick, or URL-encoded variants thereof. Web application firewalls should flag requests containing HTML/JavaScript payloads in form fields. Review pharmacy staff activity for creation of suspicious medicine entries, particularly those with embedded scripts or obfuscated content. Log and alert on any outbound requests initiated from the pharmacy system to external domains.

Why prioritize this

Although the CVSS score is LOW, prioritize patching because: (1) public exploits reduce time-to-weaponization; (2) healthcare systems face elevated regulatory scrutiny; (3) authenticated insider threats are a known risk vector; (4) the pharmacy domain handles sensitive inventory and patient data. Organizations with strict access controls and lower insider-threat profiles may delay remediation slightly, but should still schedule patching within 30 days.

Risk score, explained

The CVSS 3.5 (LOW) reflects limited direct impact: integrity only, no confidentiality or availability loss, requires authentication and user interaction. However, context matters—a pharmacy system in a healthcare facility carries higher business risk than the base score alone suggests. The availability of public exploits raises practical risk, warranting active monitoring and timely patching despite the low numeric severity.

Frequently asked questions