{"id":"CVE-2026-94016","state":"PUBLISHED","title":"SourceCodester Drug Recommendation System add_symptom cross site scripting","description":"A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file /drug_recommender/Admin/add_symptom. Performing a manipulation of the argument txtname results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.","publishedAt":"2026-09-20T12:15:11.566Z","updatedAt":"2026-09-28T07:45:07.754Z","severity":{"score":4.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Drug Recommendation System"],"affected":[{"vendor":"SourceCodester","product":"Drug Recommendation System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*"]}],"references":["https://vuldb.com/vuln/407956","https://vuldb.com/vuln/407956/cti","https://vuldb.com/cve/CVE-2026-94016","https://vuldb.com/submit/944874","https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/xss/add_symptom/Readme.md","https://www.sourcecodester.com/"],"weaknesses":["CWE-79","CWE-94"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/94xxx/CVE-2026-94016.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-94016","state":"PUBLISHED","datePublished":"2026-09-20T12:15:11.566Z","dateUpdated":"2026-09-28T07:45:07.754Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-09-19T15:22:04.011Z"},"containers":{"cna":{"title":"SourceCodester Drug Recommendation System add_symptom cross site scripting","descriptions":[{"lang":"en","value":"A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file /drug_recommender/Admin/add_symptom. Performing a manipulation of the argument txtname results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks."}],"affected":[{"vendor":"SourceCodester","product":"Drug Recommendation System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*"]}],"references":[{"url":"https://vuldb.com/vuln/407956","name":"VDB-407956 | SourceCodester Drug Recommendation System add_symptom cross site scripting","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/407956/cti","name":"VDB-407956 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-94016","name":"CVE-2026-94016 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/944874","name":"Submit #944874 | SourceCodester Drug Recommendation System Using Machine Learning, PHP, and MySQL Database 1.0 Cross Site Scripting","tags":["third-party-advisory"]},{"url":"https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/xss/add_symptom/Readme.md","tags":["exploit"]},{"url":"https://www.sourcecodester.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.8,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":2.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":2.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":3.3,"vectorString":"AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-09-28T07:45:07.754Z"},"timeline":[{"time":"2026-09-19T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-09-19T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-09-28T09:46:18.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"KaranParelkar","type":"finder"},{"lang":"en","value":"anubhav106 (VulDB User)","type":"reporter"},{"lang":"en","value":"anubhav106 (VulDB User)","type":"analyst"}],"tags":["x_freeware"],"x_generator":["VulDB PVTS v202609"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-22T18:07:58.076675Z","id":"CVE-2026-94016","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-22T18:08:06.062Z"}}]}}}