CVE-2026-8136

Vulnerability

Overview

The SourceCodester Pharmacy Sales and Inventory System version 1.0 contains a reflected cross-site scripting (XSS) vulnerability in the /index.php?page=users endpoint. The root cause is improper sanitization of the name parameter: user-supplied input is directly echoed to the web page without encoding or filtering, enabling attackers to inject arbitrary HTML or JavaScript code [1].

Attack

Vector

The vulnerability can be triggered remotely with no authentication required. An attacker crafts a malicious link containing a payload (e.g., <script>prompt(/xss/);</script>) in the name parameter and delivers the crafted URL to a victim. The victim's browser then executes the injected script because the server returns the payload unmodified [1].

Impact

Successful exploitation allows an attacker to execute arbitrary script code in the victim's browser. This can lead to session theft, cookie exfiltration, defacement, or redirection to malicious sites, compromising user privacy and system security [1].

Mitigation

As of the publication date, no patch has been released. The vendor, SourceCodester, offers the affected software for download [2]. Users should apply input validation and output encoding on the name parameter, and consider disabling the endpoint until a fix is provided.