Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-7194: Pharmacy Sales and Inventory System 1.0 Can Be Hacked via Unsecured Input

CVE-2026-7194 · published 6 months ago

Summary

The Pharmacy Sales and Inventory System 1.0 has a security weakness that could allow an attacker to access sensitive data or disrupt the system. This is because the system doesn't properly check user input, making it vulnerable to exploitation by hackers. Users of this system should update to a fixed version as soon as possible to protect their data.

Original advisory text

A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=save_product. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-74Injection

CWE-89SQL Injection

Timeline

Published27 Apr 2026

Updated3 Nov 2026

First seen28 Apr 2026

Sources

CVE-2026-7194 · NVD

Track software like this

Free during beta