A weakness in the SourceCodester Web-based Pharmacy Product Management System allows an attacker to manipulate session handling, causing the system to forcibly expire user sessions. This manipulation can lead to denial of service by disrupting legitimate user activity. The CVE notes that remote exploitation is possible and the public has released a proof‑of‑concept tool, although the complexity of the attack is considered high and the exploit requires considerable effort. The impact is limited to service availability and does not appear to expose confidential data or enable further privilege escalation.

SourceCodester Web-based Pharmacy Product Management System 1.0.

The vulnerability carries a CVSS score of 2.3, indicating a low overall risk. The EPSS score is below 1 %, showing a very low probability that exploits are actively being used, and the issue is not listed in the CISA KEV catalog. The attack vector is remote and requires high complexity skills, but the exploit is publicly available. Given the low score and difficulty, the threat remains primarily a potential denial of service rather than a critical exploitation vector.