CVE-2026-10255

MEDIUM

SourceCodester Pharmacy Sales and Inventory System ShowForm.php sell_statement access control

Title source: cna
STIX 2.1

Description

A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is the function sell_statement of the file application/controllers/ShowForm.php. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-367533 | SourceCodester Pharmacy Sales and Inventory System ShowForm.php sell_statement access control
https://vuldb.com/vuln/367533
Signature, Permissions Required signature permissions-required
VDB-367533 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/367533/cti
Third Party Advisory third-party-advisory
CVE-2026-10255 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-10255
Third Party Advisory third-party-advisory
Submit #824148 | SourceCodester Pharmacy Sales and Inventory System 1.0 Information Disclosure
https://vuldb.com/submit/824148
Exploit exploit issue-tracking
https://github.com/timeflies123/cve/issues/7

Scores

CVSS v3 5.3
EPSS 0.0051
EPSS Percentile 39.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-266 CWE-284
Status published
Products (1)
SourceCodester/Pharmacy Sales and Inventory System 1.0
Published Jun 01, 2026
Tracked Since Jun 01, 2026