CVE-2026-108919 Details
Description
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function of the file Auth/add_student.php of the component Student Registration. This manipulation of the argument txtname/txtpassword/txtemail/txtphone/txtprevious_school causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
A cross-site scripting (XSS) vulnerability has been identified in SourceCodester Drug Recommendation System version 1.0. The issue arises in the Student Registration component, specifically within an unknown function of the file Auth/add_student.php. The vulnerability is triggered by manipulating the arguments txtname, txtpassword, txtemail, txtphone, and txtprevious_school. This weakness can be exploited remotely, and the public availability of the exploit increases the risk of attack.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/submit/970936 | CISA-ADP | Issue TrackingPermission Required |
| https://vuldb.com/cve/CVE-2026-108919 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/970936 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416732 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416732/cti | [email protected] | Content Wall |
| https://www.sourcecodester.com/ | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SourceCodester Drug Recommendation System | 1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |