CVE-2026-7746

MediumCVSS 6.3/10Last modified Oct 26, 2026

Description

A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected is an unknown function of the file /product_expiry/edit-admin.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: May 4, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-774606.5EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-ema CVE-2026-774636.5Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. From 1.0.0 until 1.16.2, Re CVE-2026-774657.5toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser i CVE-2026-774668.3Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options CVE-2026-774677.1Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not ap CVE-2026-774686.9Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation conf CVE-2026-77479.8A security flaw has been discovered in Totolink N300RH 3.2.4-B20220812. Affected by this vulnerability is the function loginauth of the file CVE-2026-774708.3Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow ac CVE-2026-774736.5AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyn CVE-2026-774747.1destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior CVE-2026-77488.8A weakness has been identified in Totolink N300RH 3.2.4-B20220812. Affected by this issue is the function setUpgradeFW of the file /cgi-bin/CVE-2026-774808.8Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.