CVE-2026-10245: Pharmacy Sales Inventory System XSS Flaw

CVE-2026-10245 Overview

CVE-2026-10245 is a cross-site scripting (XSS) vulnerability [CWE-79] in SourceCodester Pharmacy Sales and Inventory System 1.0. The flaw resides in the create_supplier function within the /ShowForm/create_supplier/main endpoint. Attackers can manipulate the company_name parameter to inject arbitrary script content that executes in the browsers of users who view supplier data. The attack can be launched remotely over the network and requires low privileges plus user interaction. A public exploit has been disclosed, increasing the likelihood of opportunistic abuse against exposed deployments.

Critical Impact
Authenticated attackers can store malicious JavaScript through the supplier creation form, enabling session theft, credential capture, and pivoting against pharmacy administrators who view the affected records.

Affected Products

SourceCodester Pharmacy Sales and Inventory System 1.0
create_supplier function in /ShowForm/create_supplier/main
Deployments exposing the supplier management workflow to untrusted users

Discovery Timeline

2026-06-01 - CVE-2026-10245 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10245

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the supplier creation workflow of the Pharmacy Sales and Inventory System. The create_supplier function consumes the company_name POST parameter without sanitization or output encoding. Attackers can inject HTML or JavaScript payloads that persist in the supplier record and execute when administrators or other authenticated users render supplier listings.

Because the exploit has been published, defenders should treat this as opportunistically exploitable on internet-facing instances. Successful exploitation yields script execution in the victim's authenticated session context, which can lead to cookie theft, forced administrative actions, and downstream compromise of inventory data.

Root Cause

The root cause is missing input validation and missing output encoding on the company_name field. The application stores user-supplied text verbatim and reflects it into HTML responses without contextual escaping. This pattern matches the [CWE-79] weakness for improper neutralization of input during web page generation.

Attack Vector

Exploitation occurs over the network against the /ShowForm/create_supplier/main endpoint. The attacker submits a crafted company_name value containing script content through the supplier creation form. The payload activates when a user with access to supplier views renders the affected record. The vector requires authenticated, low-privileged access and a victim interaction to trigger execution. Refer to the GitHub Issue Report and the VulDB CVE Report for additional technical context.

Detection Methods for CVE-2026-10245

Indicators of Compromise

Supplier records containing HTML tags such as <script>, <img onerror=...>, or javascript: URIs in the company_name field
POST requests to /ShowForm/create_supplier/main with payloads containing angle brackets or encoded script content
Anomalous outbound requests from administrator browser sessions to attacker-controlled domains shortly after viewing supplier pages

Detection Strategies

Inspect web server access logs for POST /ShowForm/create_supplier/main entries containing suspicious characters in the company_name parameter
Run database queries against the suppliers table to identify rows with <, >, script, or onerror substrings in name fields
Deploy a Content Security Policy (CSP) report-only header to capture inline script violations originating from supplier views

Monitoring Recommendations

Alert on web application firewall (WAF) signatures matching reflected and stored XSS patterns on supplier endpoints
Track session anomalies such as unusual privilege changes, password resets, or supplier modifications following administrator activity
Review browser console errors and CSP reports submitted by authenticated administrative users

How to Mitigate CVE-2026-10245

Immediate Actions Required

Restrict access to the supplier creation workflow to trusted, authenticated personnel only
Audit existing supplier records and remove or sanitize entries containing HTML or JavaScript content
Place the application behind a WAF with stored XSS rule sets enabled until a vendor fix is available

Patch Information

No official vendor patch has been published in the referenced advisories at the time of CVE assignment. Operators should monitor the SourceCodester project page and the VulDB Vulnerability Details entry for fix announcements. Until a patch is released, apply compensating controls and code-level hardening in any forked or self-maintained copies of the application.

Workarounds

Add server-side input validation that rejects HTML metacharacters in the company_name parameter before insertion
Apply contextual output encoding (HTML entity encoding) wherever supplier fields are rendered in templates
Enforce a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins
Limit supplier management access through role-based controls so untrusted accounts cannot reach the vulnerable form

bash

# Configuration example: nginx WAF-style rule to block angle brackets in company_name
location /ShowForm/create_supplier/main {
    if ($request_method = POST) {
        if ($request_body ~* "company_name=[^&]*(<|%3C|script|onerror)") {
            return 403;
        }
    }
    proxy_pass http://pharmacy_backend;
}