Description
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function of the file Auth/add_student.php of the component Student Registration. This manipulation of the argument txtname/txtpassword/txtemail/txtphone/txtprevious_school causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Update System
AI Analysis

Impact

A user input form in SourceCodester Drug Recommendation System 1.0 contains a cross‑site scripting (XSS) flaw that can be triggered by manipulating the txtname, txtpassword, txtemail, txtphone, or txtprevious_school fields in the add_student.php page. The vulnerability allows a remote attacker to inject and execute arbitrary JavaScript in the context of the victim's browser, which could be used for session hijacking, defacement, or phishing attacks against users of the system.

Affected Systems

SourceCodester develops the Drug Recommendation System, version 1.0. The vulnerability resides in the Student Registration component, specifically in the add_student.php file.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate risk, and the EPSS score is not available, so the likelihood of widespread exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog, but publicly disclosed exploits exist, and the attack vector is remote via the web. The potential impact is primarily on user confidentiality and integrity of the browser session rather than on the server state.

Generated by OpenCVE AI on October 12, 2026 at 19:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update SourceCodester Drug Recommendation System to the latest version containing the XSS fix.
  • Enforce strict input validation and output encoding for the txtname/txtpassword/txtemail/txtphone/txtprevious_school parameters to neutralize injected scripts.
  • Deploy a web application firewall rule set that blocks or sanitizes malicious script payloads targeting the add_student.php endpoint.

Generated by OpenCVE AI on October 12, 2026 at 19:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function of the file Auth/add_student.php of the component Student Registration. This manipulation of the argument txtname/txtpassword/txtemail/txtphone/txtprevious_school causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Title SourceCodester Drug Recommendation System Student Registration add_student.php cross site scripting
First Time appeared Sourcecodester
Sourcecodester drug Recommendation System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester drug Recommendation System
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Drug Recommendation System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-13T16:26:29.600Z

Reserved: 2026-10-11T17:10:35.162Z

Link: CVE-2026-108919

cve-icon Vulnrichment

Updated: 2026-10-13T16:26:24.598Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T19:16:38.047

Modified: 2026-10-13T17:17:22.270

Link: CVE-2026-108919

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T20:15:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')