CVE-2026-9564
XSS in Hospitals Patient Records Management System
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sourcecodester | oretnom23_hospitals_patient_records_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The CVE-2026-9564 vulnerability is a Cross-Site Scripting (XSS) issue found in the Hospital's Patient Records Management System version 1.0. It exists in the '/admin/?page=patients/view_patient' file, specifically in the 'remarks' parameter. An attacker can inject malicious script code through this parameter, which is then output directly to the web page without proper encoding or filtering.
This allows arbitrary script execution in a victim's browser, enabling actions such as stealing cookies, session tokens, or sensitive data, performing unauthorized operations, defacing web pages, or redirecting users to malicious sites.
The vulnerability can be exploited remotely and does not require login or authorization.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute arbitrary scripts in your browser when you visit the affected web page. This can lead to theft of cookies, session tokens, or other sensitive information.
Attackers could perform unauthorized actions on your behalf, deface the website, or redirect you to malicious sites, potentially compromising your security and privacy.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the 'remarks' parameter in the '/admin/?page=patients/view_patient' page for Cross-Site Scripting (XSS) issues.
A common detection method is to inject a simple XSS payload such as `<script>prompt(/xss/);</script>` into the 'remarks' parameter and observe if the script executes in the browser.
You can use tools like curl or browser developer tools to send requests with the payload and check the response.
- Example curl command to test the vulnerability: curl -G 'http://target/admin/?page=patients/view_patient' --data-urlencode 'remarks=<script>prompt(/xss/);</script>'
- Alternatively, use a web vulnerability scanner that supports XSS detection targeting the 'remarks' parameter.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing proper output encoding and input validation on the 'remarks' parameter to prevent malicious script injection.
Additional measures include setting Content Security Policy (CSP) headers to restrict script execution, and configuring cookies with secure and HttpOnly flags to protect session data.
Regular security audits and code reviews should be conducted to identify and fix similar vulnerabilities.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a Cross-Site Scripting (XSS) issue that allows attackers to execute arbitrary scripts in users' browsers, potentially leading to theft of session tokens, cookies, or sensitive data.
Such unauthorized access and exposure of sensitive patient data could lead to non-compliance with data protection regulations like GDPR and HIPAA, which mandate the protection of personal and health information.
Failure to properly secure patient records and prevent unauthorized data access may result in violations of these standards, potentially causing legal and financial repercussions for the affected organization.