CVE-2026-105705— SourceCodester Drug Recommendation System add_drug.php cross site scripting
Quick assessment
Affected
SourceCodester Drug Recommendation System
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 SourceCodester Drug Recommendation System 1.0 中发现了一个安全漏洞。该漏洞影响了 Admin/add_drug.php 文件中的某个未知函数。通过精心构造的恶意操作，可导致跨站脚本攻击（XSS）。攻击者可远程实施该攻击。目前相关利用代码已公开，可能被攻击者用于实际攻击。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105705
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SourceCodester Drug Recommendation System add_drug.php cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file Admin/add_drug.php. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SourceCodester | Drug Recommendation System | 1.0 |
cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-105705
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105705
请登录查看更多情报信息。
News Coverage for CVE-2026-105705 (1)
Other References for CVE-2026-105705 (1)
Other References for CVE-2026-105705 (4)
-
https://vuldb.com/cve/CVE-2026-105705 third-party-advisory
-
-
https://vuldb.com/submit/992054 third-party-advisory
Same Patch Batch · SourceCodester · 2026-10-06 · 3 CVEs total
| CVE-2026-105704 | 7.3 HIGH | SourceCodester Drug Recommendation System Auth Guard improper authentication |
| CVE-2026-105706 | 4.3 MEDIUM | SourceCodester Drug Recommendation System cross-site request forgery |
IV. Related Vulnerabilities
Same product: Drug Recommendation System
-
CVE-2026-105706
SourceCodester Drug Recommendation System cross-site request -
CVE-2026-105704
SourceCodester Drug Recommendation System Auth Guard imprope -
CVE-2026-105179
SourceCodester Drug Recommendation System Password add_user. -
CVE-2026-105178
SourceCodester Drug Recommendation System Symptom Creation a -
CVE-2026-105177
SourceCodester Drug Recommendation System Drug Creation add_
Same vendor: SourceCodester
-
CVE-2026-105706
SourceCodester Drug Recommendation System cross-site request -
CVE-2026-105704
SourceCodester Drug Recommendation System Auth Guard imprope -
CVE-2026-105247
SourceCodester Online Reviewer Management System btn_functio -
CVE-2026-105246
SourceCodester Online Reviewer Management System btn_functio -
CVE-2026-105182
SourceCodester Online Reviewer Management System btn_functio
Same weakness: CWE-79
-
CVE-2026-75962
Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross- -
CVE-2026-105708
imgproxy SVG svg.go sanitizeElement cross site scripting -
CVE-2026-39760
WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Script -
CVE-2026-105784
Joplin whiteboard card rendering allows CSS injection into a -
CVE-2026-105694
Penpot: Stored XSS via Unsanitised SVG Uploads
V. Comments for CVE-2026-105705
No comments yet