CVE-2026-86301

code-projects Hospital Information System Patient Management editPatient.php cross site scripting

View on CVE.org
Published Sep 7, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Analysis

AI-generated

Technical impact

The system contains a reflected XSS flaw in the editPatient.php script, where an attacker can manipulate the id parameter to inject malicious JavaScript. This defect can be triggered remotely without authentication and leads to the execution of arbitrary code in the victim's browser, allowing session hijacking, data theft, or defacement. The vulnerability is classified under CWE‑79.

Affected Systems

The flaw is present in code‑projects Hospital Information System version 1.0, specifically in the Patient Management component within editPatient.php. Only this version of the product is known to be affected.

Risk and Exploitability

The CVSS score of 5.1 labels the vulnerability as medium severity, while the EPSS score is not available, leaving the exact exploitation probability uncertain. The flaw is not listed in the CISA KEV catalog, suggesting limited known widespread exploitation. The attack can be launched over the network from any host capable of reaching the vulnerable endpoint, making it a genuine remote threat.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the most recent patch released by the vendor for the Hospital Information System to eliminate the XSS vulnerability.
  • Validate the id parameter on the server side and encode or escape output before reflecting user input in the page.
  • Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to pre‑approved origins.

Generated by OpenCVE AI on September 7, 2026 at 14:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Title code-projects Hospital Information System Patient Management editPatient.php cross site scripting
First Time appeared Code-projects
Code-projects hospital Information System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:code-projects:hospital_information_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects hospital Information System
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 8, 2026, 2:06 PM
Reserved
Sep 6, 2026, 4:36 PM

View source JSON

Updated
Sep 8, 2026, 2:05 PM

JSON

Status
Deferred
Published
Sep 7, 2026, 12:17 PM
Modified
Sep 8, 2026, 3:18 PM

View source JSON

No data.

Updated
Sep 7, 2026, 2:30 PM

JSON