PT-2025-29543 · Unknown · Pharmacy Pos Php Script

Published 2025-07-15 · Updated 2025-07-16 · CVE-2025-40724

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Pharmacy POS PHP Script (affected versions not specified)

Description A stored Cross-Site Scripting (XSS) issue exists in Pharmacy POS PHP Script. Successful exploitation allows an attacker to execute JavaScript code in a victim’s browser. This is achieved by sending a malicious URL utilizing the u medicine name parameter in the /edit medicine.php endpoint. This can lead to the theft of sensitive user data, such as session cookies, or actions performed on behalf of the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-40724

Affected Products

Pharmacy Pos Php Script

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-40724 · Security Note
• https://t.me/cvenotify/129123 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-pharmacy-pos-php-script · Note
• https://twitter.com/incibe_cert/status/1945084431049302045 · Twitter Post
• https://twitter.com/CVEnew/status/1945435478620348417 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1945440850198011963 · Twitter Post