The vulnerability arises from the absence of encryption when handling passwords in SourceCodester Drug Recommendation System 1.0, specifically within the Admin/add_user.php component of the Password Handler. Because passwords are stored or transmitted without cryptographic protection, an attacker who can manipulate the Password argument can obtain these credentials in plain text, enabling unauthorized access or further compromise of the system. The weakness pertains to encryption and key management, as indicated by CWEs 310 and 311.

SourceCodester Drug Recommendation System version 1.0, with the vulnerable file being Admin/add_user.php in the Password Handler component. No other product or version information is specified in the CVE data.

The CVSS score of 5.1 classifies this weakness as medium severity. The attack can be launched remotely by a malicious actor who supplies a crafted Password argument. While EPSS data is not available, the publicly released exploit suggests that exploitation is feasible in practice. This vulnerability is not listed in the CISA KEV catalog, indicating that known exploits have not yet been observed in widespread attacks at the time of reporting. The primary risk is the loss of confidentiality for stored user credentials; integrity and availability are not directly impacted.