PT-2026-35432 · Sourcecodester · Pharmacy Sales/Inventory System

Christychen11 · Published 2026-04-27 · Updated 2026-04-27 · CVE-2026-7130

NVD

CVSS v2.0

7.5

High

AV:N/AC:L/Au:N/C:P/I:P/A:P

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete category. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-7130

Affected Products

Pharmacy Sales/Inventory System

References · 9

• 🔥 https://github.com/lonelyuan/vunls/issues/11 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7130 · Security Note
• https://twitter.com/KaitanSecurity/status/2048771667728449707 · Twitter Post
• https://vuldb.com/vuln/359729 · Note
• https://twitter.com/CVEnew/status/2048852162495557982 · Twitter Post
• https://vuldb.com/vuln/359729/cti · Note
• https://vuldb.com/submit/800975 · Note
• https://twitter.com/VulmonFeeds/status/2048858038979747980 · Twitter Post
• https://sourcecodester.com · Note