CVE-2026-26704
Published: 02 March 2026
Summary
CVE-2026-26704 is a critical-severity SQL Injection (CWE-89) vulnerability in Oretnom23 Pharmacy Point Of Sale System. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection in /pharmacy/view_category.php by enforcing input validation mechanisms to reject malicious SQL payloads.
Requires timely identification, reporting, and correction of the specific SQL injection flaw documented in CVE-2026-26704.
Deploys boundary protection such as web application firewalls to inspect and block SQL injection attempts targeting the vulnerable endpoint.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQLi in public-facing web app directly maps to T1190 for initial exploitation; arbitrary queries enable direct DB data collection (T1213.006) and stored data manipulation/deletion (T1565.001).
NVD Description
sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_category.php.
Deeper analysisAI
CVE-2026-26704 is an SQL Injection vulnerability (CWE-89) in the sourcecodester Pharmacy Point of Sale System version 1.0, specifically affecting the /pharmacy/view_category.php component. Published on 2026-03-02T18:16:26.553, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its potential for severe impact.
The vulnerability can be exploited by unauthenticated remote attackers over the network with low attack complexity and no requirement for user interaction. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, allowing attackers to execute arbitrary SQL queries, potentially leading to data extraction, modification, or deletion within the application's database.
A bug report detailing the vulnerability is available at https://github.com/Thirtypenny77/bug_report/blob/main/sourcecodester/pharmacy-point-sale-system/SQL-1.md. No official patches or mitigation guidance from vendors is referenced in the available information.
Details
- CWE(s)