Description
A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/user_record.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross Site Scripting
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an input validation flaw that allows an attacker to inject and execute arbitrary scripts when supplying the name or email parameters in the Admin/user_record.php page. This cross‑site scripting (XSS) flaw can lead to session hijacking, defacement, or the execution of malicious code in the browser of an authenticated administrator. The weakness is captured by CWE‑79 (Cross‑Site Scripting) and CWE‑94 (Eval or similar arbitrary code execution).

Affected Systems

The affected product is SourceCodester Drug Recommendation System, version 1.0, as disclosed in the official vulnerability report. No other versions or components are listed as affected in the data provided.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be launched remotely by manipulating the name/email arguments, and the exploit has been publicly disclosed. The medium risk level reflects the potential for client-side compromise but does not grant the attacker system‑level access.

Generated by OpenCVE AI on October 12, 2026 at 19:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update SourceCodester Drug Recommendation System to the latest version that addresses the XSS issue
  • Sanitize and encode all user‑supplied input for the name and email fields before rendering them in the admin interface
  • Implement strict validation rules to reject or neutralize script tags and other disallowed characters in the name and email parameters
  • Deploy a web application firewall rule set that blocks typical XSS payloads targeting admin/user_record.php

Generated by OpenCVE AI on October 12, 2026 at 19:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/user_record.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Title SourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scripting
First Time appeared Sourcecodester
Sourcecodester drug Recommendation System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester drug Recommendation System
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Drug Recommendation System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-15T15:14:27.534Z

Reserved: 2026-10-11T17:10:44.079Z

Link: CVE-2026-108920

cve-icon Vulnrichment

Updated: 2026-10-15T13:51:11.965Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T19:16:38.240

Modified: 2026-10-15T16:17:40.933

Link: CVE-2026-108920

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T20:15:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')