XSS in Pharmacy Pos PHP Script
CVE-2025-40724
Stored Cross-Site Scripting (XSS) vulnerability in Pharmacy POS PHP Script. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the u_medicine_name parameter in /edit_medicine.php. This vulnerability can be exploited to steal sensitive user data such as session cookies or to perform actions on behalf of the user.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (30.2th percentile) — read the EPSS interpretation.
Affected products
- Pharmacy Pos Php Script — versions all versions