A vulnerability exists in the User Management component of SourceCodester Drug Recommendation System, where unfiltered input submitted via the txtname, txtemail, and txtpassword arguments of the /drug_recommender/Admin/add_user endpoint can be used to inject malicious scripts. The flaw permits an attacker to deliver scripts that run in the context of a victim’s browser, potentially enabling actions such as session hijacking, data theft, or defacement. The weakness is a classic reflected or stored XSS flaw (CWE‑79) and may also allow code injection through improperly sanitized parameters (CWE‑94). The impact is limited to the browsers of users who interact with the affected interface, but it can compromise confidentiality, integrity, and availability of user sessions.

The affected product is SourceCodester Drug Recommendation System version 1.0, as identified in the source code at /drug_recommender/Admin/add_user. No other versions or components are listed in the CVE data. The vulnerability is triggered through remote HTTP requests to the add_user function, which processes user-supplied values without proper sanitization.

The CVSS score of 5.1 indicates a moderate risk. EPSS data are not available, but the vulnerability has been publicly disclosed and a proof‑of‑concept has been released, implying that exploitation is feasible. The flaw can be triggered remotely via crafted web requests to the add_user endpoint. It is not currently listed in the CISA KEV catalog, but the public availability of the exploit means it could be used by adversaries. The combination of remote reach, moderate severity, and publicly known exploit means that systems running the affected version should consider the vulnerability as actionable threat.