# CVE-2026-10245: SourceCodester Pharmacy Sales and Inventory System XSS in create_supplier

Source: https://junglewise.ai/threats/cve-2026-10245-sourcecodester-pharmacy-sales-and-inventory-system-xss-in-create  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-10245 · Severity: low · CVSS 3.5 · Published 2026-06-01

SourceCodester Pharmacy Sales and Inventory System 1.0 is vulnerable to a security flaw that allows attackers to inject malicious scripts into the application. This occurs when creating a new supplier, where the system fails to properly clean the company name input. If an attacker successfully exploits this, they could potentially steal session information or perform unauthorized actions on behalf of other users who view the affected page.

Technologies: [SourceCodester Pharmacy Sales and Inventory System](https://junglewise.ai/threats/technologies/pharmacy-sales-and-inventory-system). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-10245 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10245 being exploited in the wild.

**How severe is CVE-2026-10245?** Low severity, with a CVSS score of 3.5, published 1 June 2026.

**Which products and versions are affected?** SourceCodester Pharmacy Sales and Inventory System 1.0.

**Is there a fix for CVE-2026-10245?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10245 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10245?** Check whether you run SourceCodester Pharmacy Sales and Inventory System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the SourceCodester Pharmacy Sales and Inventory System 1.0. The flaw is located in the create_supplier function within the /ShowForm/create_supplier/main file. The root cause is the improper neutralization of user-supplied input in the 'company_name' parameter, which is subsequently rendered in the web interface without adequate encoding or filtering. A remote attacker with low privileges can exploit this by submitting a malicious script as a company name. When an administrative user views the supplier list or details, the script executes in their browser context, potentially allowing for session hijacking or unauthorized administrative actions. A public proof-of-concept (PoC) using a simple alert script has been disclosed.

## Affected products

- SourceCodester Pharmacy Sales and Inventory System 1.0

## Timeline

- 2026-05-09: disclosed: Vulnerability details and PoC shared on GitHub by researcher timeflies123.
- 2026-06-01: advisory: CVE-2026-10245 published.

## References

- [https://github.com/timeflies123/cve/issues/3](https://github.com/timeflies123/cve/issues/3)
- [https://vuldb.com/cve/CVE-2026-10245](https://vuldb.com/cve/CVE-2026-10245)
- [https://vuldb.com/submit/823937](https://vuldb.com/submit/823937)
- [https://vuldb.com/vuln/367523](https://vuldb.com/vuln/367523)
- [https://vuldb.com/vuln/367523/cti](https://vuldb.com/vuln/367523/cti)
- [https://www.sourcecodester.com/](https://www.sourcecodester.com/)

## Related threats

- [SourceCodester Pharmacy Sales and Inventory System improper access control in ShowForm](https://junglewise.ai/threats/cve-2026-10255-sourcecodester-pharmacy-sales-and-inventory-system-improper)
- [SourceCodester Pharmacy Sales and Inventory System CSV injection in Supplier Creation Interface](https://junglewise.ai/threats/cve-2026-10248-sourcecodester-pharmacy-sales-and-inventory-system-csv-injection)
- [SourceCodester Pharmacy Sales and Inventory System XSS in create_generic_name](https://junglewise.ai/threats/cve-2026-10247-sourcecodester-pharmacy-sales-and-inventory-system-xss-in-create)
- [SourceCodester Pharmacy Sales and Inventory System XSS in create_medicine_presentation](https://junglewise.ai/threats/cve-2026-10246-sourcecodester-pharmacy-sales-and-inventory-system-xss-in-create)
- [SourceCodester Pharmacy Sales and Inventory System XSS in medicine_name](https://junglewise.ai/threats/cve-2026-10244-sourcecodester-pharmacy-sales-and-inventory-system-xss-in)