CVE-2026-7129

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function of the file /index.php?page=categories. Performing a manipulation of the argument ID results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Apr 27, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-712909.1Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting ha CVE-2026-712918.8Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the CVE-2026-712927.2Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request CVE-2026-712936.2Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that r CVE-2026-712947.6Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/CVE-2026-712975.4A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authent CVE-2026-712986.4A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API CVE-2026-712996.5A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote att CVE-2026-71307.3A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /aj CVE-2026-713009.8Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 befor CVE-2026-713014.3Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission.CVE-2026-713027.1The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attack