Description
A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-09-07
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The system contains a reflected XSS flaw in the editPatient.php script, where an attacker can manipulate the id parameter to inject malicious JavaScript. This defect can be triggered remotely without authentication and leads to the execution of arbitrary code in the victim's browser, allowing session hijacking, data theft, or defacement. The vulnerability is classified under CWE‑79.

Affected Systems

The flaw is present in code‑projects Hospital Information System version 1.0, specifically in the Patient Management component within editPatient.php. Only this version of the product is known to be affected.

Risk and Exploitability

The CVSS score of 5.1 labels the vulnerability as medium severity, while the EPSS score is not available, leaving the exact exploitation probability uncertain. The flaw is not listed in the CISA KEV catalog, suggesting limited known widespread exploitation. The attack can be launched over the network from any host capable of reaching the vulnerable endpoint, making it a genuine remote threat.

Generated by OpenCVE AI on September 7, 2026 at 14:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the most recent patch released by the vendor for the Hospital Information System to eliminate the XSS vulnerability.
  • Validate the id parameter on the server side and encode or escape output before reflecting user input in the page.
  • Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to pre‑approved origins.

Generated by OpenCVE AI on September 7, 2026 at 14:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 07 Sep 2026 12:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Title code-projects Hospital Information System Patient Management editPatient.php cross site scripting
First Time appeared Code-projects
Code-projects hospital Information System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:code-projects:hospital_information_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects hospital Information System
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Hospital Information System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-07T11:45:06.661Z

Reserved: 2026-09-06T16:36:35.158Z

Link: CVE-2026-86301

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-07T12:17:21.680

Modified: 2026-09-07T12:17:21.680

Link: CVE-2026-86301

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T14:30:17Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')