Drug Recommendation System CVE-2026-94034

Requires an authenticated session to the SourceCodester Drug Recommendation System 1.0 admin panel (endpoint /drug_recommender/Admin/change_password) and active user interaction - the victim must submit the Password Change form carrying the payload (UI:P). Because the injected txtoldpassword/txtnewpassword fields are values the acting user enters into their own form, exploitation is effectively self-directed (self-XSS) with no demonstrated path to attack a different user; impact is limited to the authenticated user's own browser context. No confidentiality or availability impact.

This is a high-CVSS-optics-free but genuinely low-real-risk issue, and even the vendor's CVSS 4.0 base score of 2.0 correctly reflects that. The vector CVSS:4.0/AV:N/AC:L/PR:L/UI:P/VC:N/VI:L/VA:N confirms the flaw requires an authenticated user (PR:L) plus active user interaction (UI:P) and yields only limited integrity impact (VI:L) with no confidentiality or availability effect. Critically, the affected endpoint is /drug_recommender/Admin/change_password - an authenticated admin's own Password Change form - and the injected parameters (txtoldpassword/txtnewpassword) are values the same user types into their own form, making this effectively self-XSS with no cross-user attack path evident in the data. Exploitation status: publicly available exploit code exists (POC on GitHub, VulDB-referenced), but there is no EPSS score provided, no CISA KEV listing, and no evidence of active exploitation - POC availability must not be conflated with real-world exploitation. Net: not a patching priority; the combination of authentication requirement, required user interaction, self-directed injection surface, and integrity-only impact keeps genuine risk minimal.

An authenticated admin is lured (via a crafted link or form auto-submission) into submitting the change_password form with a malicious payload in the txtoldpassword or txtnewpassword field, which is reflected unsanitized and executes JavaScript in the admin's browser session. A public POC exists (GitHub KaranParelkar), but because the injection point is the user's own password-change form, realistic cross-victim exploitation is limited and largely reduces to self-XSS.