CVE-2026-3766 — Cross-site Scripting in Web-based Pharmacy Product Management System

CWE-79 — Cross-site ScriptingCWE-94 — Code Injection3 documents3 sources
Severity
5.1MEDIUMNVD
EPSS
0.0%
top 89.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Sourcecodester Web-based Pharmacy Product Management SystemSenior-walter Web-based Pharmacy Product Management System
Timeline
PublishedMar 8

Description

A security flaw has been discovered in SourceCodester Web-based Pharmacy Product Management System 1.0. This impacts an unknown function of the file edit-profile.php. Performing a manipulation of the argument fullname results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages2 packages

🔴Vulnerability Details

2
CVEList
SourceCodester Web-based Pharmacy Product Management System edit-profile.php cross site scripting↗2026-03-08
▶
GHSA
GHSA-64p3-jfqp-3g8m: A security flaw has been discovered in SourceCodester Web-based Pharmacy Product Management System 1↗2026-03-08
▶
CVE-2026-3766 — Cross-site Scripting | cvebase