CVE-2026-10247: SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Remove

   Remove SourceCodester Pharmacy Sales and Inventory System /ShowForm/create_generic_name/main from your environment.

   If the create_generic_name function is not required, remove or disable this endpoint to eliminate the vulnerable code path.

2. Configuration

   Validate and sanitize the generic_name parameter on the server side and apply proper HTML output encoding before rendering it in any page. Ensure characters such as <, >, &, ' and " are escaped or encoded according to the HTML context to prevent reflected/stored XSS.

   SourceCodester Pharmacy Sales and Inventory System - /ShowForm/create_generic_name/main generic_name input handling = server-side validation and context-appropriate output encoding
3. Configuration

   Add a strict Content-Security-Policy header to responses (for example, disallow inline scripts and allow scripts only from trusted origins) to reduce the impact of potential XSS exploitation.

   HTTP response headers (web server / application) Content-Security-Policy = restrict script-src to trusted origins; disallow inline scripts where possible
4. Compensating control

   Deploy a Web Application Firewall (WAF) or equivalent filtering to block XSS payloads targeting the create_generic_name endpoint and consider restricting access to /ShowForm/create_generic_name/main to trusted IPs or authenticated users until the application is fixed.

5. Operational

   Monitor webserver and application logs for suspicious requests and exploitation attempts against the create_generic_name endpoint; investigate and perform incident response if signs of compromise are detected.

Event History

Frequently Asked Questions