CVE-2026-10246: SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting
A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function createmedicinepresentation of the file /ShowForm/createmedicinepresentation/main. The manipulation of the argument medicinepresentation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Pharmacy Sales and Inventory System 1.0from your environment.If the application or the create_medicine_presentation functionality is not required, uninstall the application or disable/remove that functionality to eliminate exposure.
- Configuration
Sanitize and HTML-encode (escape) the medicine_presentation argument before rendering it to users; implement server-side input validation or reject unsafe input in create_medicine_presentation to prevent reflected/stored XSS.
SourceCodester Pharmacy Sales and Inventory System (file: /ShowForm/create_medicine_presentation/main, function: create_medicine_presentation) output_encoding/input_validation = apply HTML-encoding and server-side validation - Compensating control
Deploy a web application firewall or input-filtering rules to block XSS payloads targeting the medicine_presentation parameter, and restrict external access to the vulnerable endpoint until a code fix is applied.
- Operational
Monitor application logs and web access logs for exploitation attempts targeting create_medicine_presentation; if compromise is suspected, invalidate affected sessions and take incident-response actions (containment, forensics, credential rotation) as appropriate.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10246?
The severity of CVE-2026-10246 is rated low with a score of 3.5.
What type of vulnerability is CVE-2026-10246?
CVE-2026-10246 is a cross-site scripting (XSS) vulnerability.
How does CVE-2026-10246 affect the SourceCodester Pharmacy Sales and Inventory System?
CVE-2026-10246 affects the create_medicine_presentation function, allowing for the manipulation of input leading to XSS attacks.
How can I fix the vulnerability identified in CVE-2026-10246?
To fix CVE-2026-10246, sanitize and validate user input to prevent the injection of malicious scripts.
Which version of the software is affected by CVE-2026-10246?
CVE-2026-10246 affects version 1.0 of the SourceCodester Pharmacy Sales and Inventory System.