CVE-2026-26707 is a critical SQL injection flaw (CVSS 9.8) in Pharmacy Point of Sale System 1.0, a PHP project from sourcecodester. The weak point is /pharmacy/view_supplier.php. The record names no fixed release, so the practical fix is to correct the query code or take the app offline.
What's affected
The NVD record lists Pharmacy Point of Sale System version 1.0 as vulnerable, in the file /pharmacy/view_supplier.php. This is one of 5 SQL injection CVEs assigned against Pharmacy Point of Sale System 1.0 in the same batch, each tied to a different file. Fixing one file does not fix the others.
No patched version is named in the record or in the public report it links to. Treat every copy of version 1.0 as exposed until you have changed the code yourself or confirmed a newer release with the project page.
How to check if you're exposed
Start with inventory. Does anyone in your company run Pharmacy Point of Sale System? Check web roots, old demo servers and developer machines, since projects like this often come from tutorials and end up on a forgotten VM.
grep -rl "view_supplier.php" /var/www 2>/dev/null | head
Then read the code for view_supplier.php and see whether request parameters reach a query as plain string concatenation.
A dependency scan will not catch this one, because the flaw lives in the application's own code. A code scan or a web application scan finds the same class of bug.
What to do now
- Decide whether the application needs to exist. Sample and tutorial projects often do not, and removing one ends the risk.
- If it must stay, take it off the public internet and put it behind a VPN or an IP allow list.
- Rewrite the query in
view_supplier.phpto use prepared statements with bound parameters (PDO or mysqli prepared queries in PHP). Do the same for every other file that builds SQL from request data. - Run the database account with the fewest rights the app needs. It should not own the schema or read tables the app does not use.
- Check the web server and database logs for odd query errors or unusually long requests to this path, and rotate any credentials stored in the database if you find signs of probing.
Why it matters
SQL injection (CWE-89) happens when an application builds a database query by pasting user input into the SQL text. The database cannot tell which part was meant as data and which as instructions, so a crafted value can change what the query does. The CVSS vector for this record, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, says it can be reached over the network with no login and no user action, which is why it scores 9.8.
The record is not marked as exploited in the wild, and it does not appear in the CISA Known Exploited Vulnerabilities catalog. A public write-up exists, though, so anyone who finds the software online has a head start. The lasting fix is a habit, not a patch: parameterized queries everywhere.
Quick check
Is there a patch for CVE-2026-26707?
The record and the report it links to name no fixed version. Check the project page for a newer release, and plan to fix the query code yourself.
Will a dependency scan find this?
No. The bug is in the application's own PHP code, not in a third party library. Use a code scan or a web application scan for this class of flaw.
Sources
Last reviewed: 19 October 2026.
