CVE-2026-105176: SourceCodester Drug Recommendation System edit_class.php sql injection

Published Oct 5, 2026

Updated

A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. Impacted is an unknown function of the file /Admin/editclass.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Affected Software

1 affected component

SourceCodester Drug Recommendation System=1.0

Event History

Oct 5, 2026

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The available data indicates that exploitation requires high privileges (PR:H). The vulnerable endpoint is remotely reachable, but the data does not establish that unauthenticated or low-privileged users can exploit it.

Is there evidence that exploitation is practical?

Yes. The exploit has been publicly disclosed and is reported as potentially usable. The CVSS vector also rates attack complexity as low.

Which component should be investigated?

Investigate the handling of the ID argument in /Admin/edit_class.php in SourceCodester Drug Recommendation System 1.0. The reported weakness is SQL injection in an unspecified function of that file.