Description
A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file /drug_recommender/Admin/add_symptom. Performing a manipulation of the argument txtname results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Published: 2026-09-20
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: Cross Site Scripting
Action: Patch ASAP
AI Analysis

Impact

A vulnerability in the Drug Recommendation System’s add_symptom feature allows an attacker to inject malicious script code through the txtname argument. By manipulating this parameter, an attacker can execute browser code in the context of other users who view the affected page, potentially leading to session hijacking, data theft, or phishing. The flaw is a classic reflected XSS flaw, classified as CWE‑79, and the presence of CWE‑94 indicates possible code injection concerns as well.

Affected Systems

SourceCodester’s Drug Recommendation System version 1.0 is affected. The vulnerability resides in the /drug_recommender/Admin/add_symptom file and impacts any deployment of that product version.

Risk and Exploitability

The CVSS score of 4.8 rates the vulnerability as moderate in severity. No EPSS score is currently available, and the flaw is not listed in CISA’s KEV catalog, though the public exploit release suggests that attackers can already leverage it remotely via crafted web requests.

Generated by OpenCVE AI on September 20, 2026 at 13:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest version of the Drug Recommendation System if a vendor patch is available
  • Validate and sanitize the txtname input parameter, removing or encoding any HTML or JavaScript constructs before rendering
  • Implement a strict Content Security Policy header to prevent execution of unexpected scripts

Generated by OpenCVE AI on September 20, 2026 at 13:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file /drug_recommender/Admin/add_symptom. Performing a manipulation of the argument txtname results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Title SourceCodester Drug Recommendation System add_symptom cross site scripting
First Time appeared Sourcecodester
Sourcecodester drug Recommendation System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester drug Recommendation System
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Drug Recommendation System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-20T12:15:11.566Z

Reserved: 2026-09-19T15:22:04.011Z

Link: CVE-2026-94016

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-20T13:17:46.723

Modified: 2026-09-20T13:17:46.723

Link: CVE-2026-94016

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T13:45:07Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')