The vulnerability CVE-2026-94033 in SourceCodester Drug Recommendation System 1.0 is a cross-site scripting flaw in the User Management module's add_user functionality. Manipulation of the input parameters txtname, txtemail, or txtpassword can lead to injection of malicious scripts, which can be executed in the context of the victim's browser. The attack can be launched remotely without elevated privileges but requires user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and user interaction needed.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or redirection to malicious sites. The vulnerability requires user interaction and low privileges, which limits the scope but still poses a risk to users interacting with the vulnerable interface.

No official patch or remediation details are provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to apply input validation and output encoding on the affected parameters to prevent script injection.