CVE-2026-7126
published 2026-04-27CVE-2026-7126: A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file…
PriorityP344high7.3CVSS 3.1
AVNACLPRNUINSUCLILAL
EPSS
0.25%
16.8th percentile
A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /ajax.php?action=save_category. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sourcecodester | pharmacy_sales_and_inventory_system | — | — |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mgc8-vv7r-23wc: A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1
ghsa_unreviewed·2026-04-27
CVE-2026-7126 [MEDIUM] CWE-74 GHSA-mgc8-vv7r-23wc: A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1
A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /ajax.php?action=save_category. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
VulDB
SourceCodester Pharmacy Sales and Inventory System 1.0 ajax.php?action=save_category ID sql injection
vuldb·2026-04-26·CVSS 6.9
CVE-2026-7126 [MEDIUM] SourceCodester Pharmacy Sales and Inventory System 1.0 ajax.php?action=save_category ID sql injection
A vulnerability categorized as critical has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /ajax.php?action=save_category. The manipulation of the argument ID results in sql injection.
This vulnerability is cataloged as CVE-2026-7126. The attack may be launched remotely. Furthermore, there is an exploit available.
Red Hat
kernel: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
vendor_redhat·2026-06-25·CVSS 7.0
CVE-2026-53249 [MEDIUM] CWE-266 kernel: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
kernel: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
In the Linux kernel, the following vulnerability has been resolved:
ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
This patch restricts setting Loose Source and Record Route (LSRR)
and Strict Source and Record Route (SSRR) IP options to users
with CAP_NET_RAW capability.
This prevents unprivileged applications from forcing packets to route
through attacker-controlled nodes to leak TCP ISN and possibly other
protocol information.
While LSRR and SSRR are commonly filtered in many network environments,
they may still be supported and forwarded along some network paths.
RFC 7126 (Recommendations on Filtering of IPv4 Packets Containing
IPv4 Options) recommend to drop these options in 4.3 and 4.4.
A flaw was found in the Linux kernel's
No detection rules found.
No public exploits indexed.
2026-04-27
Published