CVE-2026-10245 Details

A cross-site scripting (XSS) vulnerability has been identified in SourceCodester Pharmacy Sales and Inventory System version 1.0. The issue arises in the 'create_supplier' function within the file '/ShowForm/create_supplier/main'. The vulnerability allows remote attackers to inject malicious scripts by manipulating the 'company_name' parameter, which is then output to the web page without proper encoding or filtering. This flaw could be exploited to execute arbitrary scripts in the context of the user's browser, potentially leading to unauthorized actions or the theft of sensitive information such as cookies or session tokens.

To address this vulnerability, implement proper output encoding for user inputs before displaying them on the web page. Validate and filter input data to reject or escape potentially malicious content, such as script tags or event handlers. Consider using a Content Security Policy (CSP) to restrict the execution of unauthorized scripts. For sensitive cookies, set the HttpOnly and Secure flags to protect against theft via JavaScript and ensure transmission over HTTPS. Regular security audits can help identify and fix XSS vulnerabilities.