CVE-2026-10255 PUBLISHED

A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is the function sell_statement of the file application/controllers/ShowForm.php. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

• timeflies (VulDB User) reporter

• VDB-367533 | SourceCodester Pharmacy Sales and Inventory System ShowForm.php sell_statement access control
• VDB-367533 | CTI Indicators (IOB, IOC, TTP, IOA)
• CVE-2026-10255 | CVE Analysis and Report
• Submit #824148 | SourceCodester Pharmacy Sales and Inventory System 1.0 Information Disclosure
• https://github.com/timeflies123/cve/issues/7
• https://www.sourcecodester.com/

• Improper Access Controls CWE
• Incorrect Privilege Assignment CWE