CVE-2025-9921 Details

A stored cross-site scripting vulnerability has been identified in Code-Projects POS Pharmacy System version 1.0. The issue resides in the products.php file, where product information is retrieved from the database and displayed without proper escaping of special characters. This flaw allows attackers to inject malicious JavaScript into fields such as product_code, gen_name, product_name, and supplier. When other users, including administrators, access the products.php page, the injected scripts are executed by the browser. This vulnerability could be exploited to hijack sessions, steal sensitive information, conduct phishing attacks, or abuse permissions, especially if the victim is an administrator.

It is recommended to escape all user-controllable data before outputting it to the HTML page. This can be done using the htmlspecialchars() function. Additionally, input validation should be strengthened to restrict special characters and allow only legal characters through a whitelist mechanism.