Quick answers
- Is CVE-2026-92927 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-92927 being exploited in the wild.
- How severe is CVE-2026-92927?
- Medium severity, with a CVSS score of 5.3, published 17 September 2026.
- Which products and versions are affected?
- SourceCodester Drug Recommendation System 1.0.
- Is there a fix for CVE-2026-92927?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-92927 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-92927?
- Check whether you run SourceCodester Drug Recommendation System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a sensitive information disclosure (CWE-200) where plaintext database credentials are embedded in the publicly distributed /db/drug_recommendor.sql file. The vulnerable component is the database initialization script itself, which contains hardcoded credentials accessible via direct file download without authentication. An attacker can obtain these credentials by downloading the source code from SourceCodester and opening the SQL dump file in any text editor. Once credentials are obtained, an attacker can connect to the MySQL database and extract or modify sensitive information. The remediation requires removing credentials from the distribution, using encrypted/hashed credentials, and rotating any exposed credentials.
Affected products
- SourceCodester Drug Recommendation System 1.0
Timeline
- 2026-09-17: disclosed: CVE-2026-92927 published; exploit code made public on GitHub