Medium severity · published Apr 29, 2026
CVE-2026-7392
SourceCodester Pharmacy Sales and Inventory System ajax.php delete_supplier sql injection
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function delete_supplier of the file /ajax.php?action=delete_supplier. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PS
Pharmacy Sales and Inventory System · SourceCodester
1.0 · source: vendor
Affected product
PS
Pharmacy Sales and Inventory System
SourceCodester
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7392
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7392
github.com
https://github.com/microwaveabi/vul/issues/2
vuldb.com
https://vuldb.com/submit/803107
vuldb.com
https://vuldb.com/vuln/360117
vuldb.com
https://vuldb.com/vuln/360117/cti
www.sourcecodester.com
https://www.sourcecodester.com/
More from Pharmacy Sales and Inventory System
7.3
CVE-2026-8083
SourceCodester Pharmacy Sales and Inventory System ajax.php save_user sql injection
7.3
CVE-2026-7550
SourceCodester Pharmacy Sales and Inventory System ajax.php save_customer sql injection
7.3
CVE-2026-7549
SourceCodester Pharmacy Sales and Inventory System ajax.php delete_customer sql injection
7.3
CVE-2026-7199
SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
7.3
CVE-2026-7194
SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection