CVE-2026-3170

SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System patient-search.php cross site scripting

View on CVE.org
Published Feb 25, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected is an unknown function of the file /patient-search.php. The manipulation of the argument First Name/Last Name results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used.

Analysis

AI-generated

Technical impact

The vulnerability allows an attacker to inject malicious script by submitting specially crafted values for the first name or last name fields in patient-search.php. This reflected cross‑site scripting can execute arbitrary code in the victim’s browser, enabling session hijacking, data theft, or site defacement.

Affected Systems

Patrick Mvuma and SourceCodester supply the Patients Waiting Area Queue Management System. The affected version is 1.0, as identified by the CPE string.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1% suggests a low current probability of exploitation. The issue is not listed in KEV. An attacker can reach the vulnerable endpoint remotely by sending crafted HTTP requests; no special privileges are required on the target system.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update or patch the system to a version that implements proper input validation for the name fields.
  • Apply server‑side sanitization and output encoding—e.g., use htmlspecialchars—to any data rendered from the first name or last name parameters.
  • Deploy a web‑application firewall rule to detect and block suspicious XSS payloads targeting patient-search.php.

Generated by OpenCVE AI on April 17, 2026 at 15:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Patrick Mvuma
Patrick Mvuma patients Waiting Area Queue Management System
Sourcecodester
Sourcecodester patients Waiting Area Queue Management System
Vendors & Products Patrick Mvuma
Patrick Mvuma patients Waiting Area Queue Management System
Sourcecodester
Sourcecodester patients Waiting Area Queue Management System
Type Values Removed Values Added
First Time appeared Pamzey
Pamzey patients Waiting Area Queue Management System
CPEs cpe:2.3:a:pamzey:patients_waiting_area_queue_management_system:1.0:*:*:*:*:*:*:*
Vendors & Products Pamzey
Pamzey patients Waiting Area Queue Management System
Type Values Removed Values Added
Description A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected is an unknown function of the file /patient-search.php. The manipulation of the argument First Name/Last Name results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used.
Title SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System patient-search.php cross site scripting
Weaknesses CWE-79
CWE-94
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Feb 25, 2026, 4:53 PM
Reserved
Feb 24, 2026, 10:01 PM

View source JSON

Updated
Feb 25, 2026, 4:53 PM

JSON

Status
Analyzed
Published
Feb 25, 2026, 8:16 AM
Modified
Jun 17, 2026, 10:43 AM

View source JSON

No data.

Updated
Apr 17, 2026, 3:30 PM

JSON