Description
A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.
Published: 2026-09-03
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A reflected cross‑site scripting flaw exists in the Online Medicine Delivery System’s index.php page, triggered when an attacker manipulates the query string parameter "q=orderdetails". The application fails to validate or sanitize the supplied value before rendering it, allowing arbitrary HTML and script code to be injected into the response. According to the vulnerability description, this weakness corresponds to Input Validation Failure (CWE‑79) and Code Injection (CWE‑94). An attacker who successfully injects script can steal session cookies, hijack user sessions, deface the page, or redirect users to malicious sites.

Affected Systems

The affected product is itsourcecode Online Medicine Delivery System version 1.0. Because no other versions are specified, all installations running this release remain vulnerable until a vendor patch or mitigation is applied.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploit is publicly available, and an attacker can launch the attack remotely by crafting a malicious URL to the vulnerable endpoint.

Generated by OpenCVE AI on September 3, 2026 at 21:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available vendor patch or newer release that fixes the XSS issue.
  • Remove or properly sanitize user‑supplied data that is passed to the q=orderdetails parameter, using context‑appropriate HTML escaping before it is rendered.
  • Configure a web application firewall or server rule to detect and block reflected XSS payloads on the /index.php?q=orderdetails endpoint.

Generated by OpenCVE AI on September 3, 2026 at 21:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.
Title itsourcecode Online Medicine Delivery System index.php cross site scripting
First Time appeared Itsourcecode
Itsourcecode online Medicine Delivery System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:itsourcecode:online_medicine_delivery_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode online Medicine Delivery System
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Online Medicine Delivery System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-03T19:15:09.207Z

Reserved: 2026-09-03T13:14:51.369Z

Link: CVE-2026-85207

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-03T20:17:27.613

Modified: 2026-09-03T20:17:27.613

Link: CVE-2026-85207

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T21:45:09Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')