Drug Recommendation System CVE-2026-94016

Requires an authenticated high-privilege administrator account to reach and submit the /drug_recommender/Admin/add_symptom form (PR:H), and requires a victim to subsequently view the page rendering the stored txtname value (UI:P/interaction). Exploitation is therefore effectively limited to the admin context - an already-privileged operator injecting script that fires in an admin's browser - which is closer to self-XSS than a cross-privilege attack. No special non-default configuration is stated, but the admin-authentication and victim-view requirements are the primary limiting factors.

Low real-world priority despite a public exploit. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/E:P) scores only 4.8 and its own metrics tell the story: PR:H means the attacker must already hold high (administrator) privileges, and UI:P means a victim must interact with the injected content. The affected endpoint path /drug_recommender/Admin/add_symptom confirms an authenticated admin-panel function, so the injection is largely self-XSS by an already-privileged operator with limited additional gain (VC:N, VI:L, VA:N - integrity-only, no confidentiality or availability impact). SSVC-style reading: exploitation is 'Proof of Concept' (E:P) and technical impact is partial, not total. There is no EPSS score, no CISA KEV listing, and only VulDB reporting - signals that point to a low-value CVE-mill entry rather than a targeted or widespread threat. A public POC exists (GitHub, KaranParelkar), but POC availability is NOT the same as active exploitation; there is no evidence of in-the-wild use. Net: high-CVSS is not in play here - this is a genuinely low-risk, admin-context XSS.

An authenticated administrator submits the 'add_symptom' form with a malicious script payload in the txtname argument, which is stored and later rendered without sanitization, executing JavaScript in the browser of an admin viewing that data. A public proof-of-concept for the txtname parameter is available on GitHub, but exploitation requires existing high-privilege (admin) access plus a victim viewing the injected page, sharply limiting practical impact.