Pharmacy Management System CVEs and Security Vulnerabilities

CVE-2026-31070

Privilege Escalation via Unauthenticated Role Assignment in Pharmacy Management System

The LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote attackers to escalate privileges by self-assigning an administrative role during registration. The /api/user/signup endpoint fails to validate the role parameter in the request body

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Lalanachami

Products

Pharmacy Management System

CVE-2026-31071

Unauthenticated API Access Exposing User Data and Allowing Inventory Modification

API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access private medical prescription data via /api/doctorOder.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed