Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-94033: SourceCodester Drug Recommendation System allows XSS in add_user

CVE-2026-94033 · published 29 days ago

Summary

The user‑creation page in the SourceCodester Drug Recommendation System does not properly filter the name, email or password fields, so an attacker can inject malicious code that runs in a browser. This could let an attacker display unwanted content or steal information from anyone who views the page. Apply the vendor’s patch or update the code to clean and validate all input before it is displayed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
sourcecodester	drug recommendation system	1.0

Original advisory text

SourceCodester Drug Recommendation System User Management add_user cross site scripting

A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drug_recommender/Admin/add_user of the component User Management. Such manipulation of the argument txtname/txtemail/txtpassword leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

References

https://vuldb.com/cve/CVE-2026-94033 third-party-advisory
https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/xss/add_us... exploit
https://vuldb.com/submit/946133 third-party-advisory
https://vuldb.com/vuln/407961 vdb-entry technical-description
https://vuldb.com/vuln/407961/cti signature permissions-required
https://www.sourcecodester.com/ product

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.0 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

CWE-94Code Injection

Timeline

Published20 Sep 2026

Updated19 Oct 2026

First seen20 Sep 2026

Sources

CVE-2026-94033 · NVD

CVE-2026-94033 · MITRE

Track software like this

Free during beta