A vulnerability, which was classified as critical, was found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?action=save_receiving. Executing a manipulation of the argument ID can lead to sql injection.
This vulnerability is tracked as CVE-2026-7088. The attack can be launched remotely. Moreover, an exploit is present.
