The vulnerability identified as CVE-2026-7088 affects SourceCodester Pharmacy Sales and Inventory System 1.0. It involves SQL injection through the ID argument in the /ajax.php?action=save_receiving file. This allows an unauthenticated remote attacker to manipulate SQL queries executed by the application, potentially compromising the database. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impacts on confidentiality, integrity, and availability. No official patch or vendor advisory has been published yet.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium based on the CVSS score and vector, reflecting limited but significant risk to confidentiality, integrity, and availability of the system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint, applying web application firewall (WAF) rules to detect and block SQL injection attempts, and monitoring for suspicious activity related to the /ajax.php?action=save_receiving endpoint. Avoid exposing the vulnerable system to untrusted networks if possible.