CVE-2026-3170
Cross-Site Scripting in Patients Waiting Area Queue System
Publication date: 2026-02-25
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pamzey | patients_waiting_area_queue_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-3170 is a Stored Cross-Site Scripting (XSS) vulnerability in the Patients Waiting Area Queue Management System version 1.0, specifically in the /patient-search.php file.'}, {'type': 'paragraph', 'content': 'The vulnerability occurs because the application does not properly sanitize user input in the First Name and Last Name fields during patient registration. An attacker can register a patient record with malicious JavaScript code embedded in these fields.'}, {'type': 'paragraph', 'content': "When an authenticated user, such as a nurse or administrator, searches for patients using the 'Find Patient' module, the malicious script is retrieved from the database and executed in their browser. This allows arbitrary script execution within the context of the affected application."}] [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can lead to the execution of arbitrary scripts in the browsers of authenticated users interacting with the patient search functionality.
- It can enable attackers to hijack user sessions.
- It may allow unauthorized access to sensitive patient data.
- Attackers could potentially take over administrative accounts.
Since the exploit is publicly available and can be executed remotely, it poses a significant security risk to the confidentiality and integrity of the system and its users.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the patient search functionality for stored cross-site scripting (XSS) issues. One method is to register a patient with a malicious payload in the First Name or Last Name fields, such as "><img src=x onerror=alert(1)>", and then searching for that patient to see if the script executes in the browser.'}, {'type': 'paragraph', 'content': 'Additionally, vulnerable targets can be identified using Google dorking with the query: inurl:patient-search.php'}, {'type': 'paragraph', 'content': 'There are no specific commands documented for automated detection, but manual testing by injecting typical XSS payloads into the patient registration fields and observing the behavior in the /pqms/patient-search.php module is recommended.'}] [1, 3]
What immediate steps should I take to mitigate this vulnerability?
No known countermeasures or mitigations have been documented for this vulnerability.
It is suggested to replace the affected software with an alternative product to avoid the risk posed by this stored XSS vulnerability.