PT-2026-23977 · Sourcecodester · Sourcecodester Web-Based Pharmacy Product Management System

Denil Xavier · Publicado 2026-03-08 · Atualizado 2026-03-08 · CVE-2026-3766

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Web-based Pharmacy Product Management System version 1.0

Description A security flaw exists in SourceCodester Web-based Pharmacy Product Management System 1.0. The issue impacts an unknown function within the edit-profile.php file. Manipulating the fullname argument can lead to cross site scripting. The attack can be initiated remotely, and the exploit has been publicly released.

Recommendations Apply any available updates or patches for version 1.0. As a temporary workaround, consider sanitizing the fullname input to prevent script injection. Restrict access to the edit-profile.php file if possible.

Exploit

Correção

XSS

Code Injection

Enumeração de Fraquezas

CWE-79

CWE-94

Identificadores relacionados

CVE-2026-3766

Produtos afetados

Sourcecodester Web-Based Pharmacy Product Management System

Referências · 10

• 🔥 https://gist.github.com/Denilxavier/6b21cb788f7f545179286f6c44989448 · Exploit
• https://t.me/cveNotify/154717 · Publicação no Telegram
• https://vuldb.com/?id.349744 · Nota
• https://vuldb.com/?ctiid.349744 · Nota
• https://sourcecodester.com · Nota
• https://t.me/CVEtracker/46837 · Publicação no Telegram
• https://vuldb.com/?submit.768251 · Nota
• https://twitter.com/CVEnew/status/2030747833184461175 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-3766 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-3766 · Nota de Segurança