Description
A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drug_recommender/Admin/change_password of the component Password Change. Performing a manipulation of the argument txtoldpassword/txtnewpassword results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used.
Published: 2026-09-20
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Cross‑Site Scripting via the password change function
Action: Apply Patch
AI Analysis

Impact

A flaw in the password change endpoint of SourceCodester’s Drug Recommendation System allows an attacker to supply malicious JavaScript in the txtoldpassword or txtnewpassword fields. The application reflects the supplied input back into the page response without adequate sanitization, causing the browser to execute the injected code when the page is rendered.

Affected Systems

This vulnerability affects the SourceCodester Drug Recommendation System application, version 1.0. No other products or versions are listed as vulnerable.

Risk and Exploitability

The flaw carries a CVSS score of 5.1, indicating moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. However, the vulnerability is publicly known, an exploit is available, and the attacker can trigger it remotely by sending crafted requests to the /drug_recommender/Admin/change_password endpoint. These conditions make real‑world exploitation a credible threat.

Generated by OpenCVE AI on September 20, 2026 at 17:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and install the vendor’s official patch that implements input validation and output encoding for the password change page.
  • If no patch is available, perform server‑side filtering of the txtoldpassword and txtnewpassword fields, rejecting or escaping any script‑related characters before processing or rendering.
  • Deploy a Web Application Firewall rule or implement a Content Security Policy that blocks or warns against known XSS payload patterns targeting the /drug_recommender/Admin/change_password page.

Generated by OpenCVE AI on September 20, 2026 at 17:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drug_recommender/Admin/change_password of the component Password Change. Performing a manipulation of the argument txtoldpassword/txtnewpassword results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used.
Title SourceCodester Drug Recommendation System Password Change change_password cross site scripting
First Time appeared Sourcecodester
Sourcecodester drug Recommendation System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester drug Recommendation System
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Drug Recommendation System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-20T15:00:07.801Z

Reserved: 2026-09-19T17:48:30.104Z

Link: CVE-2026-94034

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-20T15:16:30.730

Modified: 2026-09-20T15:16:30.730

Link: CVE-2026-94034

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T17:15:17Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')