CVE-2026-10246
Description
SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to reflected XSS via the medicine_presentation parameter in create_medicine_presentation/main.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to reflected XSS via the medicine_presentation parameter in create_medicine_presentation/main.
Vulnerability
An XSS vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0, specifically in the create_medicine_presentation function located at /ShowForm/create_medicine_presentation/main. The medicine_presentation parameter is taken from user input and output directly to the web page without proper encoding or filtering, allowing injection of arbitrary script code [1]. This is a classic reflected cross-site scripting (XSS) flaw. The vulnerable version is 1.0 [1].
Exploitation
An attacker can exploit this vulnerability remotely without requiring any authentication or login [1]. The attack involves sending a crafted request containing a malicious script (e.g., a payload like `) in the medicine_presentation` parameter. When the victim visits the affected page with the malicious payload, the script executes in the context of the victim's browser [1]. No special privileges or additional user interaction beyond visiting the crafted URL is needed.
Impact
Successful exploitation allows the attacker to execute arbitrary script code in the victim's browser. This can lead to theft of cookies, session tokens, or other sensitive information; performance of actions on behalf of the victim; defacement of web pages; or redirection to malicious sites [1]. The impact is limited to the browser session and does not directly compromise the server.
Mitigation
As of the publication date, no official patch or fixed version has been released for this vulnerability [1][2]. The vendor, SourceCodester, has not released an update addressing this issue. Users should apply input validation and output encoding for the medicine_presentation parameter as a workaround until a fix is provided. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
AI Insight generated on Jun 1, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: =1.0
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Missing output encoding of the `medicine_presentation` parameter allows stored/reflected cross-site scripting."
Attack vector
An attacker sends a crafted HTTP request to `/ShowForm/create_medicine_presentation/main` with a malicious payload in the `medicine_presentation` parameter, such as `<script>alert(/xss/);</script>`. Because the application does not sanitize or encode this input before rendering it in the browser, the injected script executes in the victim's session. The CVSS vector indicates the attack requires low privileges and user interaction, but the advisory states no login or authorization is required [ref_id=1].
Affected code
The vulnerability resides in the file `/ShowForm/create_medicine_presentation/main` of the SourceCodester Pharmacy Sales and Inventory System 1.0. The function `create_medicine_presentation` outputs the user-supplied `medicine_presentation` parameter directly to the web page without encoding or filtering [ref_id=1].
What the fix does
The advisory recommends output encoding, input validation and filtering, a Content Security Policy, and secure cookie flags as remediation steps [ref_id=1]. No patch is provided in the bundle. Applying proper HTML entity encoding to the `medicine_presentation` parameter before rendering it would prevent the browser from interpreting injected script tags as executable code.
Preconditions
- networkAttacker must be able to send HTTP requests to the vulnerable endpoint
- authNo authentication is required according to the advisory
- inputVictim must interact with the crafted page (e.g., visit the URL)
Generated on Jun 1, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6News mentions
0No linked articles in our index yet.