CVE-2026-3766

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3766
A security flaw has been discovered in SourceCodester Web-based Pharmacy Product Management System 1.0. This impacts an unknown function of the file edit-profile.php. Performing a manipulation of the argument fullname results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

3.5 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://gist.github.com/Denilxavier/6b21cb788f7f545179286f6c44989448 Exploit Third Party Advisory
https://vuldb.com/?ctiid.349744 Permissions Required VDB Entry
https://vuldb.com/?id.349744 Third Party Advisory VDB Entry
https://vuldb.com/?submit.768251 Third Party Advisory VDB Entry
https://www.sourcecodester.com/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:senior-walter:web-based_pharmacy_product_management_system:1.0:*:*:*:*:*:*:*
History

09 Mar 2026, 16:28

Type Values Removed Values Added
References () https://gist.github.com/Denilxavier/6b21cb788f7f545179286f6c44989448 - () https://gist.github.com/Denilxavier/6b21cb788f7f545179286f6c44989448 - Exploit, Third Party Advisory
References () https://vuldb.com/?ctiid.349744 - () https://vuldb.com/?ctiid.349744 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.349744 - () https://vuldb.com/?id.349744 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.768251 - () https://vuldb.com/?submit.768251 - Third Party Advisory, VDB Entry
References () https://www.sourcecodester.com/ - () https://www.sourcecodester.com/ - Product
CPE cpe:2.3:a:senior-walter:web-based_pharmacy_product_management_system:1.0:*:*:*:*:*:*:*
Summary
  • (es) Una falla de seguridad ha sido descubierta en SourceCodester Web-based Pharmacy Product Management System 1.0. Esto afecta una función desconocida del archivo edit-profile.PHP. Realizar una manipulación del argumento fullname resulta en cross site scripting. El ataque puede ser iniciado remotamente. El exploit ha sido liberado al público y puede ser usado para ataques.
First Time Senior-walter
Senior-walter web-based Pharmacy Product Management System

08 Mar 2026, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-08 20:15

Updated : 2026-03-09 16:28

NVD link : CVE-2026-3766

Mitre link : CVE-2026-3766

CVE.ORG link : CVE-2026-3766

JSON object : View

Products Affected

senior-walter

  • web-based_pharmacy_product_management_system
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')