This vulnerability in SourceCodester Drug Recommendation System 1.0 allows remote attackers to perform cross-site scripting by manipulating the txtoldpassword or txtnewpassword arguments in the password change functionality located at /drug_recommender/Admin/change_password. The flaw enables injection of malicious scripts, potentially impacting users who interact with this component. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and partial impact on integrity and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking or other client-side attacks. The impact is limited to the scope of the password change component and requires user interaction. No evidence of active exploitation in the wild is reported.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to the affected component or applying web application firewall rules to detect and block suspicious input targeting the vulnerable parameters.