The vulnerability CVE-2026-94015 exists in SourceCodester Drug Recommendation System 1.0 in the /drug_recommender/Admin/edit_user.php file. An attacker can manipulate the ID argument to perform SQL injection, potentially compromising the database. The attack can be launched remotely without authentication. Public exploit code is available, increasing the risk of exploitation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium based on the CVSS score of 6.9. There is no indication of active exploitation in the wild at this time.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict access to the affected functionality and monitor for suspicious activity related to the vulnerable parameter.