rootpwn

medium · CVSS v3 5.3 · CVSS v4 6.9

CVE-2026-92927

An information disclosure vulnerability exists in SourceCodester Drug Recommendation System 1.0 within the drug_recommendor.sql file process

Overview

An information disclosure vulnerability exists in SourceCodester Drug Recommendation System 1.0 within the drug_recommendor.sql file processing. Remote attackers can leverage this flaw to access sensitive database information. Addressing this exposure is vital to prevent the leakage of internal application data.

Description

A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /db/drug_recommendor.sql. Performing a manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

Impact

This vulnerability impacts the confidentiality of the database contents stored within the system. Unauthorized remote actors can view sensitive data without requiring authentication. Administrators and users of the deployment are directly affected by the potential exposure of system records. Integrity and availability remain unaffected by this specific flaw.

Remediation

Restrict direct public access to database backup and SQL dump files via web server configuration rules. Implement proper access controls on sensitive scripts and endpoints. Review application directories to ensure no residual database setup files are left exposed to the internet. Upgrade the software or apply vendor-supplied patches if available.

Risk context

The vulnerability is rated as medium severity with a CVSS v3 score of 5.3 and CVSS v4 score of 6.9, indicating moderate risk. Although an exploit has been made public, EPSS data is currently unavailable. Remediation should be prioritized based on the exposure of the affected server to untrusted networks.

Affected products

  • SourceCodester Drug Recommendation System 1.0

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
6.9
EPSS
—

information-disclosure sourcecodester drug-recommendation-system database-exposure web-application medium-severity

← All CVEs

Related CVEs

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis

medium

CVE-2026-18441

The LatePoint Appointment Booking plugin for WordPress (v5.6.9 and earlier) contains an insecure direct object reference that allows unauthenticated users to enumerate customer records when guest checkout is enabled. Attackers can retrieve first name, last name, email, and phone number for any customer ID. This flaw exposes personally identifiable information without requiring authentication.

View analysis

medium

CVE-2026-2585

Brizy – Page Builder for WordPress has a stored cross-site scripting flaw in the rootAttributes parameter through version 2.8.14. Authenticated users with Contributor-level access or higher can inject scripts that run when visitors view affected pages. This matters because it can compromise site visitors and weaken trust in the WordPress site.

View analysis

medium

CVE-2026-93308

CVE-2026-93308 affects the VES Collector component of O-RAN-SC SMO OAM 2025-06-10. A remote attacker can manipulate an unknown functionality to trigger resource allocation, potentially exhausting system resources. The vulnerability is publicly known but no patch has been released yet.

View analysis