CVE-2020-36011
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability exists in the Add Patient Form of QDOCS Smart Hospital Management System 3.1. A remote attacker can inject arbitrary JavaScript code via fields such as Name, Guardian Name, Email, Address, Remarks, or Any Known Allergies.
Risk Assessment
The risk includes potential session hijacking, account takeover, or unauthorized actions within the hospital system, compromising patient data confidentiality.
Recommendation
Immediately update the system to the latest version and implement input filtering and validation on all fields of the Add Patient Form.
Original NVD description (English source)
A cross-site scripting (XSS) issue in Add Patient Form in QDOCS Smart Hospital Management System 3.1 allows a remote attacker to inject arbitrary code via the Name, Guardian Name, Email, Address, Remarks, or Any Known Allergies field.