Description
A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drug_recommender/Admin/change_password of the component Password Change. Performing a manipulation of the argument txtoldpassword/txtnewpassword results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used.
Published: 2026-09-20
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting via the password change function
Action: Apply Patch
AI Analysis

Impact

A flaw in the password change endpoint of SourceCodester’s Drug Recommendation System allows an attacker to supply malicious JavaScript in the txtoldpassword or txtnewpassword fields. The application reflects the supplied input back into the page response without adequate sanitization, causing the browser to execute the injected code when the page is rendered.

Affected Systems

This vulnerability affects the SourceCodester Drug Recommendation System application, version 1.0. No other products or versions are listed as vulnerable.

Risk and Exploitability

The flaw carries a CVSS score of 5.1, indicating moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. However, the vulnerability is publicly known, an exploit is available, and the attacker can trigger it remotely by sending crafted requests to the /drug_recommender/Admin/change_password endpoint. These conditions make real‑world exploitation a credible threat.

Generated by OpenCVE AI on September 20, 2026 at 17:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Obtain and install the vendor’s official patch that implements input validation and output encoding for the password change page.
  • If no patch is available, perform server‑side filtering of the txtoldpassword and txtnewpassword fields, rejecting or escaping any script‑related characters before processing or rendering.
  • Deploy a Web Application Firewall rule or implement a Content Security Policy that blocks or warns against known XSS payload patterns targeting the /drug_recommender/Admin/change_password page.

Generated by OpenCVE AI on September 20, 2026 at 17:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 20 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drug_recommender/Admin/change_password of the component Password Change. Performing a manipulation of the argument txtoldpassword/txtnewpassword results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used.
Title SourceCodester Drug Recommendation System Password Change change_password cross site scripting
First Time appeared Sourcecodester
Sourcecodester drug Recommendation System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester drug Recommendation System
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Drug Recommendation System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-28T07:45:16.356Z

Reserved: 2026-09-19T17:48:30.104Z

Link: CVE-2026-94034

cve-icon Vulnrichment

Updated: 2026-09-21T14:09:23.968Z

cve-icon NVD

Status : Deferred

Published: 2026-09-20T15:16:30.730

Modified: 2026-09-21T15:17:37.690

Link: CVE-2026-94034

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T17:15:17Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')