CVE-2026-10245: SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this issue is the function createsupplier of the file /ShowForm/createsupplier/main. Executing a manipulation of the argument companyname can lead to cross site scripting. The attack can be launched remotely. The exploit has been published and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Sanitize and validate the company_name parameter on the server side in the create_supplier function. Reject or strip HTML/JavaScript characters and apply proper contextual output encoding/escaping before rendering the value in any HTML page to prevent reflected/stored XSS.
SourceCodester Pharmacy Sales and Inventory System - /ShowForm/create_supplier/main (create_supplier) company_name input handling = server-side input validation and contextual output encoding (escape or remove HTML/JS) - Compensating control
Until code is fixed, deploy a Web Application Firewall (WAF) or IPS rule to block common XSS payloads targeting the /ShowForm/create_supplier/main endpoint, and consider restricting access to the endpoint to trusted IP ranges.
- Operational
Monitor web server and application logs for exploitation attempts against /ShowForm/create_supplier/main; if signs of compromise are detected, invalidate affected sessions and rotate any credentials or secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10245?
The severity of CVE-2026-10245 is low, with a score of 3.5 according to the CVSS.
How do I fix CVE-2026-10245?
To fix CVE-2026-10245, validate and sanitize user inputs in the create_supplier function to prevent cross-site scripting.
What software is affected by CVE-2026-10245?
CVE-2026-10245 affects SourceCodester Pharmacy Sales and Inventory System version 1.0.
What type of vulnerability is CVE-2026-10245?
CVE-2026-10245 is classified as a cross-site scripting (XSS) vulnerability.
How can CVE-2026-10245 be exploited?
CVE-2026-10245 can be exploited by manipulating the company_name parameter in the create_supplier function, allowing remote attackers to execute malicious scripts.