CVE-2026-10244: SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is the function createmedicinename of the file /ShowForm/createmedicinename/main. Performing a manipulation of the argument medicinename results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Validate and sanitize the medicine_name input on the server side and apply proper HTML output encoding/escaping before rendering to prevent cross-site scripting. Reject or escape HTML/JS characters from user-supplied medicine_name values.
SourceCodester Pharmacy Sales and Inventory System create_medicine_name (medicine_name parameter) = validate and sanitize input; apply output encoding - Configuration
Disable or restrict access to the create_medicine_name endpoint/function until a vendor patch is available (e.g., remove the form, require authentication, or restrict to internal IPs).
SourceCodester Pharmacy Sales and Inventory System create_medicine_name endpoint = disabled or access-restricted - Compensating control
Deploy web application firewall (WAF) rules or reverse-proxy filters to block or sanitize requests containing XSS payloads targeting the create_medicine_name endpoint and restrict remote access where possible.
- Operational
Review application logs and stored data for signs of exploitation; remove any stored malicious medicine_name entries and monitor for further attempts. Conduct incident response if evidence of compromise is found.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10244?
CVE-2026-10244 has a severity rating of low, specifically rated at 3.5.
How do I fix CVE-2026-10244?
To mitigate CVE-2026-10244, ensure proper input validation and sanitization for the create_medicine_name function.
What type of vulnerability is CVE-2026-10244?
CVE-2026-10244 is identified as a Cross-Site Scripting (XSS) vulnerability.
Which software is affected by CVE-2026-10244?
CVE-2026-10244 affects the SourceCodester Pharmacy Sales and Inventory System, version 1.0.
What can be the consequence of exploiting CVE-2026-10244?
Exploiting CVE-2026-10244 can lead to unauthorized script execution in a user's browser, potentially compromising user data.