CVE-2026-85207: itsourcecode Online Medicine Delivery System index.php cross site scripting
A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be launched remotely, but the CVSS vector indicates the attacker needs low-level privileges and user interaction. A public exploit is available.
What is the expected security impact?
The reported impact is limited to integrity, with no reported confidentiality or availability impact. The CVSS assessment rates the issue as low severity with a score of 3.5.
How can I identify potentially affected instances?
Review deployments of itsourcecode Online Medicine Delivery System 1.0 and inspect exposure of the order-details functionality at /index.php?q=orderdetails. The vulnerable behavior involves manipulation of the location argument.