SourceCodester Drug Recommendation System 1.0 contains a cross-site scripting vulnerability in the /drug_recommender/Admin/add_symptom endpoint. An attacker can manipulate the txtname parameter to inject malicious scripts, potentially leading to client-side code execution. The vulnerability is remotely exploitable and has a CVSS 4.8 (medium) rating. No patch or remediation information is provided, and no known exploits are reported in the wild.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited by the medium CVSS score and the requirement for user interaction (UI:P) and privileges (PR:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable functionality to trusted users and apply input validation or sanitization on the txtname parameter if possible.