CVE-2026-1147
Cross-Site Scripting in Patients Queue System API Endpoint
Publication date: 2026-01-19
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patrick_mvuma | patients_waiting_area_queue_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1147 is a Stored Cross-Site Scripting (XSS) vulnerability in the Patients Waiting Area Queue Management System version 1.0 by Patrick Mvuma. It occurs in the appointment scheduling endpoint (/php/api_patient_schedule.php) where the 'Reason' field is not properly sanitized or encoded. An attacker can inject malicious JavaScript code into this field, which is then stored and executed in the context of users viewing the dashboard, leading to Stored XSS attacks. [1, 2]
How can this vulnerability impact me? :
This vulnerability allows remote attackers to inject and execute malicious scripts in the context of other users viewing the dashboard. This can lead to compromised data integrity, potential theft of user session information, or other malicious actions performed on behalf of the victim user. Exploitation requires user interaction and is relatively easy to perform. The impact is primarily on integrity, with no direct confidentiality or availability impact noted. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the vulnerable endpoint `/php/api_patient_schedule.php` and testing the `Reason` parameter for stored cross-site scripting (XSS). A proof of concept involves injecting a script such as `<script>alert('XSS')</script>` into the Reason field and observing if it executes when viewing the dashboard. Additionally, vulnerable targets can be identified using Google dorking with queries like `inurl:php/api_patient_schedule.php` to find exposed instances. Specific network or system commands are not provided in the resources. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
No known countermeasures or mitigations have been documented for this vulnerability. It is suggested to replace the affected software with an alternative product to mitigate the risk. Immediate steps include avoiding use of the vulnerable version and monitoring for any suspicious activity related to the injection of scripts via the Reason parameter. [2]