Is CVE-2025-56274 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-56274 being exploited in the wild.

How severe is CVE-2025-56274?

High severity, with a CVSS score of 8.1, published 15 September 2025.

Is there a fix for CVE-2025-56274?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-56274 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-56274?

Check whether you run Senior-Walter Web-Based Pharmacy Product Management System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-56274: SourceCodester Web-based Pharmacy Product Management System incorrect access control in add-admin.php

CVE-2025-56274 · Severity: high · CVSS 8.1 · Published 2025-09-15

A vulnerability exists in the SourceCodester Web-based Pharmacy Product Management System, a tool used for managing pharmaceutical inventory and users. An attacker with a low-privileged account can bypass security restrictions to perform administrative tasks, such as creating new unauthorized user accounts. This could lead to a full takeover of the system and unauthorized access to sensitive pharmacy data.

Technologies: Senior-Walter Web-Based Pharmacy Product Management System. Vendors: Senior-Walter.

Quick answers

Is CVE-2025-56274 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-56274 being exploited in the wild.
How severe is CVE-2025-56274?: High severity, with a CVSS score of 8.1, published 15 September 2025.
Which products and versions are affected?: SourceCodester Web-based Pharmacy Product Management System 1.0.
Is there a fix for CVE-2025-56274?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-56274 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-56274?: Check whether you run Senior-Walter Web-Based Pharmacy Product Management System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect access control vulnerability exists in the 'add-admin.php' component of SourceCodester Web-based Pharmacy Product Management System 1.0. The application fails to properly validate the authorization level of a user session when processing administrative requests. A remote attacker with low-privileged credentials can exploit this by capturing an administrative request and substituting their own session cookies, or otherwise forging a high-privileged session. Successful exploitation allows the attacker to perform sensitive operations, such as creating new administrative users, effectively escalating their privileges to full system control. A Proof of Concept (PoC) has been disclosed demonstrating the addition of a new user via session manipulation.

Affected products

SourceCodester Web-based Pharmacy Product Management System 1.0

Timeline

2025-09-15: advisory: Initial NVD publication date
2025-09-16: other: CISA-ADP enrichment and SSVC assessment added

References

https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-56274.md

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.