Drug Recommendation System EUVD-2026-97759

Exploitation requires the ability to inject attacker-controlled input into the name or email argument processed by Admin/user_record.php, and then requires an administrator (or operator with access to the Admin Record Tables view) to render that record in their browser - the UI:P metric confirms a victim must passively view the tainted data for the payload to fire. This user-interaction requirement and the admin-view rendering context are the primary limiting factors; impact is confined to script execution in the viewing user's browser session (integrity-low, no direct server compromise). Only SourceCodester Drug Recommendation System version 1.0 is identified as affected.

This is a genuinely low-priority issue despite being publicly disclosed. The CVSS 4.0 base score of 5.3 (MEDIUM) reflects a cross-site scripting flaw requiring passive user interaction (UI:P) with only low integrity impact (VI:L) and no confidentiality or availability impact per the vendor vector. The E:P exploit-maturity metric and the description ('the exploit has been disclosed publicly') confirm publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active exploitation or high exploitation probability - POC availability and active exploitation are distinct signals and only the former is present here. The vector claims PR:N (unauthenticated) and AV:N (network), yet the affected file is Admin/user_record.php in the 'Admin Record Tables' component, which implies the malicious name/email payload is stored via a user-facing input and later rendered in an administrator's record view; this is a plausible stored-XSS pattern but the PR:N/network-reachability claim should be verified against the application's actual authentication model. Overall this is a high-noise, low-real-risk finding typical of VulDB-sourced disclosures against small open-source PHP projects.

An attacker submits a crafted name or email value containing a JavaScript payload through the application; when an administrator later opens the Admin Record Tables view (Admin/user_record.php), the stored script executes in the admin's browser session. A public proof-of-concept exists (CVSS E:P and public disclosure), lowering the effort to reproduce, though execution depends on an administrator viewing the tainted record (UI:P).