Drug Recommendation System CVE-2026-108919

Exploitation requires the Student Registration feature exposed via Auth/add_student.php to be reachable, and an attacker supplies a script payload in the txtname, txtpassword, txtemail, txtphone, or txtprevious_school parameter. The key LIMITING factor is required user interaction (UI:P): the injected payload only executes when a victim - most plausibly an administrator or operator viewing submitted registration data - renders the tainted output in a browser; it does not fire against the attacker alone. No authentication is needed to inject (PR:N per the CVSS 4.0 vector). Impact is bounded to the victim's browser session within this specific application (SourceCodester Drug Recommendation System 1.0); there is no server-side code execution.

This is a low-to-moderate priority issue despite public exploit availability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) scores 5.3 (Medium): network-reachable and unauthenticated, but requiring victim interaction (UI:P) and yielding only low integrity impact with no confidentiality or availability impact per the supplied vector. CWE-79 (cross-site scripting) is consistent with the description. Exploitation status: publicly available exploit code exists (VulDB notes the exploit has been made public), but this is distinct from active exploitation - the CVE is NOT in CISA KEV and no EPSS score was provided in the input. SSVC/automatable signals are absent. The vector's SSVC-relevant exploitation sub-score E:P (Proof-of-Concept) corroborates POC rather than weaponized use. Net: a real but modest web-app flaw; the combination of a niche hobby/educational product, required user interaction, and absence of KEV/EPSS evidence points to opportunistic rather than widespread or targeted exploitation. Note a conflict worth flagging: the input vector sets VC:N (no confidentiality impact), yet real-world XSS commonly enables session/cookie theft - verify impact scope against the actual sink behavior.

An unauthenticated attacker submits the student registration form at Auth/add_student.php with a malicious script payload in one of the fields (txtname, txtpassword, txtemail, txtphone, or txtprevious_school). When the stored/reflected value is later rendered in a browser (e.g., an administrator reviewing registrations), the injected JavaScript executes in that victim's session context. A public proof-of-concept exists, and the low attack complexity (AC:L) makes crafting the payload trivial, though execution depends on a victim viewing the tainted output (UI:P).