CVE-2026-105705
MediumCVSS 4.3Summary
A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Drug Recommendation System 1.0 in Admin/add_drug.php. Input manipulation leads to client-side script execution. The attack can be performed remotely and the exploit has been publicly released.
Risk Assessment
The XSS vulnerability may allow an attacker to steal sessions, redirect users, or execute malicious code in the victim's browser. The public exploit increases the risk of exploitation.
Recommendation
Improve input validation and sanitization in Admin/add_drug.php. Update the system or apply security patches.
Other vulnerabilities in Drug Recommendation System
See all- CVE-2026-105706Medium
A cross-site request forgery (CSRF) vulnerability was identified in SourceCodester Drug Recommendation System 1.0 in an unknown function. The attack can be performed remotely and the exploit has been made publicly available.
- CVE-2026-105175High
SQL injection vulnerability in SourceCodester Drug Recommendation System 1.0. Affects the file /Auth/add_student.php in the Student Registration component, where manipulation of the cmdschool argument allows SQL injection. The attack can be executed remotely, and the exploit is public.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file Admin/add_drug.php. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS