CVE-2026-1147
Unknown Unknown - Not Provided
Cross-Site Scripting in Patients Queue System API Endpoint

Publication date: 2026-01-19

Last updated on: 2026-04-29

Assigner: VulDB

Description
A vulnerability was found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This affects an unknown part of the file /php/api_patient_schedule.php. Performing a manipulation of the argument Reason results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-19
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-01-19
EPSS Evaluated
2026-06-15
NVD
CVE-2026-1147
EUVD
EUVD-2026-3232
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patrick_mvuma patients_waiting_area_queue_management_system 1.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-1147 is a Stored Cross-Site Scripting (XSS) vulnerability in the Patients Waiting Area Queue Management System version 1.0 by Patrick Mvuma. It occurs in the appointment scheduling endpoint (/php/api_patient_schedule.php) where the 'Reason' field is not properly sanitized or encoded. An attacker can inject malicious JavaScript code into this field, which is then stored and executed in the context of users viewing the dashboard, leading to Stored XSS attacks. [1, 2]

Impact Analysis

This vulnerability allows remote attackers to inject and execute malicious scripts in the context of other users viewing the dashboard. This can lead to compromised data integrity, potential theft of user session information, or other malicious actions performed on behalf of the victim user. Exploitation requires user interaction and is relatively easy to perform. The impact is primarily on integrity, with no direct confidentiality or availability impact noted. [1, 2]

Detection Guidance

This vulnerability can be detected by checking for the presence of the vulnerable endpoint `/php/api_patient_schedule.php` and testing the `Reason` parameter for stored cross-site scripting (XSS). A proof of concept involves injecting a script such as `<script>alert('XSS')</script>` into the Reason field and observing if it executes when viewing the dashboard. Additionally, vulnerable targets can be identified using Google dorking with queries like `inurl:php/api_patient_schedule.php` to find exposed instances. Specific network or system commands are not provided in the resources. [1, 2]

Mitigation Strategies

No known countermeasures or mitigations have been documented for this vulnerability. It is suggested to replace the affected software with an alternative product to mitigate the risk. Immediate steps include avoiding use of the vulnerable version and monitoring for any suspicious activity related to the injection of scripts via the Reason parameter. [2]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1147. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart