CVE-2026-108920
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79, CWE-94
Impact
Remote attackers can execute arbitrary JavaScript in an admin's browser session by getting malicious user input rendered in the admin dashboard. This requires tricking an admin into viewing the affected records table.
Root cause
The application fails to sanitize and escape the 'name' and 'email' parameters before rendering them in the Admin/user_record.php table.
Affected systems
SourceCodester Drug Recommendation System 1.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
No official patch is listed; sanitize and HTML-encode the name and email outputs in Admin/user_record.php, or restrict access to the Admin/ directory to trusted IP addresses.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/user_record.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.