CVE-2026-108919
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79, CWE-94
Impact
Remote attackers can execute arbitrary script code in a victim's browser if the victim interacts with a crafted request. An unauthenticated attacker needs a user to trigger the malicious input via the student registration component.
Root cause
Unsanitized user inputs in Auth/add_student.php (arguments txtname, txtpassword, txtemail, txtphone, and txtprevious_school) allow cross-site scripting.
Affected systems
SourceCodester Drug Recommendation System 1.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
No vendor patch is specified; restrict network access to Auth/add_student.php or sanitize incoming POST parameters using htmlspecialchars() in the affected script.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function of the file Auth/add_student.php of the component Student Registration. This manipulation of the argument txtname/txtpassword/txtemail/txtphone/txtprevious_school causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.