CVE-2026-5812

2.1 lowEPSS 0.2%

Low (2.1). EPSS 0.2% chance of exploitation in the next 30 days.

A security flaw has been discovered in SourceCodester Pharmacy Product Management System 1.0. This affects an unknown part of the file add-sales.php of the component POST Parameter Handler. Performing a manipulation of the argument txtqty results in business logic errors. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
CWE: CWE-840
Published: 2026-04-08
Modified: 2026-07-24
Record from: the NVD, synced 2026-10-19

References

https://github.com/meifukun/Web-Security-PoCs/blob/main/Pharmacy-Product-Management-System/Logic-AddSales-NegativeQty.md
https://vuldb.com/submit/787680
https://vuldb.com/vuln/356260
https://vuldb.com/vuln/356260/cti
https://www.sourcecodester.com/

Check your stack JSON