Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-108920: SourceCodester Drug Recommendation System allows malicious script injection
CVE-2026-108920 · published 6 days ago
Summary
The admin page in the Drug Recommendation System lets attackers insert code by submitting specially crafted name or email values. This can cause unwanted scripts to run in a user’s browser, potentially stealing data or altering the displayed information. Update the application to properly clean user input or apply a vendor patch as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sourcecodester | drug recommendation system | 1.0 |
Original advisory text
SourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scripting
A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/user_record.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
CWE-94Code Injection
Timeline
Published12 Oct 2026
Updated16 Oct 2026
First seen12 Oct 2026
Track software like this
Free during beta