PT-2026-23977 · Sourcecodester · Sourcecodester Web-Based Pharmacy Product Management System

Denil Xavier · Published 2026-03-08 · Updated 2026-03-08 · CVE-2026-3766

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Web-based Pharmacy Product Management System version 1.0

Description A security flaw exists in SourceCodester Web-based Pharmacy Product Management System 1.0. The issue impacts an unknown function within the edit-profile.php file. Manipulating the fullname argument can lead to cross site scripting. The attack can be initiated remotely, and the exploit has been publicly released.

Recommendations Apply any available updates or patches for version 1.0. As a temporary workaround, consider sanitizing the fullname input to prevent script injection. Restrict access to the edit-profile.php file if possible.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-3766

Affected Products

Sourcecodester Web-Based Pharmacy Product Management System

References · 10

• 🔥 https://gist.github.com/Denilxavier/6b21cb788f7f545179286f6c44989448 · Exploit
• https://osv.dev/vulnerability/CVE-2026-3766 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3766 · Security Note
• https://t.me/cveNotify/154717 · Telegram Post
• https://vuldb.com/?id.349744 · Note
• https://vuldb.com/?ctiid.349744 · Note
• https://sourcecodester.com · Note
• https://t.me/CVEtracker/46837 · Telegram Post
• https://vuldb.com/?submit.768251 · Note
• https://twitter.com/CVEnew/status/2030747833184461175 · Twitter Post