# CVE-2026-85207: itsourcecode Online Medicine Delivery System reflected XSS in orderdetails

Source: https://junglewise.ai/threats/cve-2026-85207-itsourcecode-online-medicine-delivery-system-reflected-xss-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85207 · Severity: low · CVSS 3.5 · Published 2026-09-03

The Online Medicine Delivery System is a PHP-based web application used by pharmacies and healthcare providers to manage medication orders online. A reflected cross-site scripting (XSS) vulnerability in the order details page allows an authenticated customer to inject malicious JavaScript code that executes in other users' browsers, potentially stealing session cookies, hijacking accounts, or stealing login credentials through fake login forms.

Technologies: [Itsourcecode Online Medicine Delivery System](https://junglewise.ai/threats/technologies/online-medicine-delivery-system). Vendors: [Itsourcecode](https://junglewise.ai/threats/vendors/itsourcecode).

## Quick answers

**Is CVE-2026-85207 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85207 being exploited in the wild.

**How severe is CVE-2026-85207?** Low severity, with a CVSS score of 3.5, published 3 September 2026.

**Which products and versions are affected?** Itsourcecode Online Medicine Delivery System 1.0.

**Is there a fix for CVE-2026-85207?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85207 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85207?** Check whether you run Itsourcecode Online Medicine Delivery System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw in the /index.php?q=orderdetails page that fails to sanitize the POST parameter 'location' before outputting it to HTML. The vulnerable code echoes the location parameter directly into three HTML contexts without using htmlspecialchars() or htmlentities() encoding: inside a span tag for delivery fee display, within an input hidden field value attribute, and in an arithmetic calculation for overall price. The attack requires an authenticated customer session and can be delivered via a crafted POST request. An attacker can inject JavaScript code that will execute in the victim's browser, enabling cookie theft, session hijacking, or phishing attacks. The vendor has published remediation guidance recommending output encoding using htmlspecialchars() and input validation for numeric values.

## Affected products

- itsourcecode Online Medicine Delivery System 1.0

## Timeline

- 2026-09-03: disclosed

## References

- [https://github.com/boyslikesports/202607_vul_dir/blob/main/H-06-XSS-Reflected-OrderDetails_en.md](https://github.com/boyslikesports/202607_vul_dir/blob/main/H-06-XSS-Reflected-OrderDetails_en.md)
- [https://itsourcecode.com/](https://itsourcecode.com/)

## Related threats

- [itsourcecode Online Medicine Delivery System unrestricted file upload in order management](https://junglewise.ai/threats/cve-2026-85208-itsourcecode-online-medicine-delivery-system-unrestricted-file)
- [itsourcecode Online Medicine Delivery System SQL injection in addwishlist](https://junglewise.ai/threats/cve-2026-85205-itsourcecode-online-medicine-delivery-system-sql-injection-in)
- [itsourcecode Online Medicine Delivery System SQL injection in order status update](https://junglewise.ai/threats/cve-2026-85187-itsourcecode-online-medicine-delivery-system-sql-injection-in)
- [itsourcecode Online Medicine Delivery System unrestricted file upload](https://junglewise.ai/threats/cve-2026-85186-itsourcecode-online-medicine-delivery-system-unrestricted-file)
- [itsourcecode Online Medicine Delivery System SQL injection in password recovery](https://junglewise.ai/threats/cve-2026-82615-itsourcecode-online-medicine-delivery-system-sql-injection-in)