CVE-2026-5812

MEDIUM

SourceCodester Pharmacy Product Management System POST Parameter add-sales.php logic error

Title source: cna

Description

A security flaw has been discovered in SourceCodester Pharmacy Product Management System 1.0. This affects an unknown part of the file add-sales.php of the component POST Parameter Handler. Performing a manipulation of the argument txtqty results in business logic errors. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

References (5)

[Vdb Entry, Technical Description] https://vuldb.com/vuln/356260

[Signature, Permissions Required] https://vuldb.com/vuln/356260/cti

[Third Party Advisory] https://vuldb.com/submit/787680

[Exploit] https://github.com/meifukun/Web-Security-PoCs/blob/main/Pharmacy-Product-Management-System/Logic-AddSales-NegativeQty.md

View Exploit ZIP pw:eip

[Product] https://www.sourcecodester.com/

Scores

CVSS v3 5.4

EPSS 0.0004

EPSS Percentile 13.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Details

CWE

CWE-840

Status published

Products (1)

SourceCodester/Pharmacy Product Management System 1.0

Published Apr 08, 2026

Tracked Since Apr 09, 2026