CVE-2025-3826

CVE-2025-3826 affects SourceCodester Web-based Pharmacy Product Management System 1.0, specifically the add-supplier.php file. The vulnerability arises from improper handling/manipulation of the arguments txtsupplier_name and txtaddress, enabling cross-site scripting (XSS). Exploitation is remote...

CVE-2025-3822

CVE-2025-3822 affects SourceCodester Web-based Pharmacy Product Management System 1.0. The issue is a cross-site scripting vulnerability in changepassword.php triggered by manipulating the arguments txtconfirm_password, txtnew_password, and txtold_password. The vulnerability can be exploited remo...

CVE-2025-3825

CVE-2025-3825 affects SourceCodester Web-based Pharmacy Product Management System v1.0, specifically the add-category.php file. The vulnerability arises from manipulation of the txtcategory_name parameter, leading to cross-site scripting. The issue can be triggered remotely and, per connected sou...

CVE-2025-3821

CVE-2025-3821 affects SourceCodester Web-based Pharmacy Product Management System 1.0. The vulnerability resides in add-admin.php, where improper handling of the inputs txtpassword, txtfullname, and txtemail enables cross-site scripting. The issue is exploitable remotely and has public exploits. ...

CVE-2025-4547

CVE-2025-4547 affects SourceCodester Web-based Pharmacy Product Management System 1.0. The Add User Page is vulnerable to cross-site scripting (XSS) in an unknown functionality, with parameters potentially affected. The attack may be launched remotely and exploits have been disclosed publicly. Co...

CVE-2025-3824

Summary: CVE-2025-3824 affects SourceCodester Web-based Pharmacy Product Management System 1.0, via an input handling flaw in the file add-product.php that allows cross-site scripting when manipulating the txtprice and txtproduct_name parameters. Several connected sources confirm remote exploitat...

CVE-2025-3764

CVE-2025-3764 affects SourceCodester Web-based Pharmacy Product Management System 1.0. The vulnerability lies in the /edit-product.php file, where manipulating the Avatar parameter enables unrestricted file upload. This can be exploited remotely, and publicly disclosed exploit information exists....

CVE-2025-3694

CVE-2025-3694 affects SourceCodester Web-based Pharmacy Product Management System 1.0, specifically the Login Handler component. The root cause isSQL injection triggered by manipulating the login_email parameter in the login flow, allowing remote exploitation. Public exploit details are reference...

CVE-2025-3697

The CVE-2025-3697 entry maps to a SQL injection in SourceCodester Web-based Pharmacy Product Management System 1.0, caused by improper handling of the ID parameter in /edit-product.php. A remote attacker could exploit this vulnerability, and public disclosures exist. The provided connected docume...

CVE-2025-3696

The CVE-2025-3696 entry covers SourceCodester Web-based Pharmacy Product Management System 1.0. A SQL injection affects the /search/search_stock.php file via manipulation of the Name parameter. This can be exploited remotely, and multiple sources confirm the vulnerability exists in the unknown co...

CVE-2025-3729

The CVE-2025-3729 entry affects SourceCodester Web-based Pharmacy Product Management System 1.0, specifically the Database Backup Handler’s backup.php. The root cause is improper handling/manipulation of the txtdbname argument, which enables os command injection. Impact is high: remote attack pot...

CVE-2025-3765

CVE-2025-3765 affects SourceCodester Web-based Pharmacy Product Management System 1.0. The issue stems from insufficient validation of the Avatar parameter in /edit-photo.php, allowing unrestricted file upload and enabling remote exploitation. Public disclosures exist, indicating an exploit is av...

CVE-2025-3783

SourceCodester Web-based Pharmacy Product Management System 1.0 contains a vulnerability in /add-product.php where the Avatar parameter allows unrestricted file upload. This enables remote exploitation and is publicly disclosed per CVE-2025-3783. Several sources confirm the issue affects an unkno...

CVE-2025-3823

CVE-2025-3823 affects SourceCodester Web-based Pharmacy Product Management System 1.0. the vulnerable area is the add-stock.php file where manipulation of the parameters txttotalcost, txtproductID, txtprice, and txtexpirydate leads to cross-site scripting. described impacts include remote exploit...

CVE-2025-45997

CVE-2025-45997 affects Sourcecodester Web-based Pharmacy Product Management System v1.0. The issue is in the file upload feature: an attacker can upload a PHP file disguised as an image by tampering the Content-Type header to image/jpg, potentially enabling remote code execution on the server. Th...

CVE-2025-3244

CVE-2025-3244 affects SourceCodester Web-based Pharmacy Product Management System 1.0. The vulnerability is in the Create User Page’s file /add-admin.php, where manipulation of the Avatar parameter enables unrestricted file upload, with remote exploitation reported. Several connected sources conf...

CVE-2025-45751

CVE-2025-45751 affects SourceCodester Web Based Pharmacy Product Management System 1.0. The issue is a Cross Site Scripting (XSS) vulnerability in add-admin.php via the Fullname field, with root cause an unvalidated Fullname input. Potential impact is client-side script execution in the context o...

CVE-2025-3383

SourceCodester Web-based Pharmacy Product Management System 1.0 contains a SQL injection in the /search/search_sales.php handler, triggered by manipulating the Name argument. Impact is described as remote exploitation with high/severe risk across multiple CVE sources, with exploitation details al...

CVE-2025-56274

SourceCodester Web-based Pharmacy Product Management System 1.0 is affected by an Incorrect Access Control flaw that lets low-privileged users forge sessions with admin-like privileges and perform sensitive actions (e.g., adding users). The CVE entry documents a high impact (CVE-2025-56274) with ...

CVE-2026-3766

SourceCodester Web-based Pharmacy Product Management System 1.0 contains a cross-site scripting vulnerability in edit-profile.php when manipulating the fullname parameter. The issue is exploitable remotely, with publicly released exploit material and a PROOF-OF-CONCEPT exploit maturity noted. Roo...

CVE-2026-30576

SourceCodester Pharmacy Product Management System 1.0 (add-stock.php) is affected by a Business Logic flaw: txtprice and txttotalcost are not validated during stock entry, enabling negative values that can corrupt financial records and be used to manipulate inventory asset values and procurement ...

CVE-2026-3401

Technical details about CVE-2026-3401 are not publicly available in the provided documents. No concrete information on affected components, root cause, or fixes is included. Monitor for updates from linked sources.

CVE-2026-30574

CVE-2026-30574 affects SourceCodester Pharmacy Product Management System 1.0, specifically the add-sales.php logic. The issue is a failure to validate that the requested sales quantity (txtqty) does not exceed available stock, allowing an attacker to Manipulate the request to oversell beyond stoc...

CVE-2025-63712

SourceCodester Product Expiry Management System’s User Management module (delete-user.php) is affected by a CSRF vulnerability. The endpoint authenticates via session cookies only and lacks CSRF protection, enabling remote attackers to delete arbitrary user accounts through forged cross-origin GE...

CVE-2026-30575

SourceCodester Pharmacy Product Management System 1.0 exposes a business logic flaw in add-stock.php: the txtqty parameter is not validated, allowing negative values to be processed and decreasing inventory instead of increasing it. This causes inventory corruption and potential DoS by depleting ...

CVE-2025-56018

CVE-2025-56018 affects SourceCodester Web-based Pharmacy Product Management System v1.0. The vulnerability is a Cross-Site Scripting (XSS) flaw in Category Management via the category name field. Root cause appears to be insufficient validation/sanitization of category name input, enabling script...

CVE-2025-65215

Sourcecodester Web-based Pharmacy Product Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the Supplier Name field of /product_expiry/add-supplier.php. The issue is documented across multiple feeds (NVD, Red Hat, ENISA, CNNVD, CVE lists) with consistent description. Root caus...

CVE-2026-30573

The CVE-2026-30573 affects SourceCodester Pharmacy Product Management System 1.0. A business logic flaw in add-sales.php allows negative values for txtprice and txttotalcost, skipping input validation. This can produce incorrect financial calculations, corrupt sales reports, and potential financi...