Drug Recommendation System CVE-2026-94035

Exploitation requires submitting a malicious payload via the 'full name' input on /drug_recommender/index.php of SourceCodester Drug Recommendation System 1.0, and the payload only fires when a victim's browser subsequently renders the unsanitized value (UI:P/UI:R - victim interaction is required, e.g., viewing the profile page per the POC). No authentication is indicated by the vendor vector (PR:N), and the app must be internet-reachable. Limiting factors: impact is confined to the victim's browser context (integrity-limited, no confidentiality or availability impact), it needs a victim to view the injected content, and the affected product is an obscure application unlikely to be exposed in production.

This is a low-to-moderate-severity reflected/stored cross-site scripting flaw (CWE-79) in the 'full name' field of /drug_recommender/index.php in SourceCodester Drug Recommendation System 1.0. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N, score 5.3) shows network reach and no privileges but requires victim interaction (UI:P) and yields only limited integrity impact with zero confidentiality or availability impact - consistent with script injection rather than data theft or takeover. Exploitation status is 'publicly available exploit code exists' (a POC is published on GitHub under xss/profile), but there is NO EPSS score, NO CISA KEV listing, and no evidence of active exploitation; POC availability is a distinct and weaker signal than in-the-wild use. The SSVC-style read is: automatable exploitation is plausible for the injection itself, but technical impact is partial and gated on a victim rendering the payload. Net: this is a real but low-priority issue - a VulDB CVE-mill entry against an obscure hobby PHP application, not an enterprise emergency. Note the source only provides a CVSS 4.0 vector, not a 3.1 vector, and the exact injection type (reflected vs. stored) is inferable but not explicitly confirmed by the description.

An attacker submits a crafted 'full name' value containing a JavaScript payload to /drug_recommender/index.php; when the value is rendered back (e.g., on a profile view page, per the POC path xss/profile), the script executes in the victim's browser session. A public POC exists on GitHub (KaranParelkar), so weaponization requires minimal skill. Impact is limited to session/UI actions in the victim's browser context - cookie theft, DOM manipulation, or phishing - with no direct server compromise.