PT-2025-35803 · Code Projects · Pos Pharmacy System

111Ctx · Published 2025-09-03 · Updated 2025-09-09 · CVE-2025-9921

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions code-projects POS Pharmacy System version 1.0

Description A weakness exists in code-projects POS Pharmacy System 1.0, potentially leading to cross-site scripting. The issue is related to the manipulation of the product code, gen name, product name, or supplier arguments within an unknown function of the /main/products.php file. This manipulation can be initiated remotely. The exploit has been made publicly available.

Recommendations As a temporary workaround, consider restricting access to the /main/products.php file to minimize the risk of exploitation. Sanitize the product code, gen name, product name, and supplier arguments before processing them within the affected function.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-9921

Affected Products

Pos Pharmacy System

References · 10

• 🔥 https://github.com/chen2496088236/CVE/issues/4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9921 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9921 · Vendor Advisory
• https://t.me/CVEtracker/31612 · Telegram Post
• https://vuldb.com/?ctiid.322322 · Note
• https://twitter.com/CVEnew/status/1963293581759696997 · Twitter Post
• https://vuldb.com/?submit.642420 · Note
• https://t.me/cveNotify/134785 · Telegram Post
• https://vuldb.com/?id.322322 · Note
• https://code-projects.org · Note