CVE-2026-11468
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Vulnerability in SourceCodester Hospitals Patient Records Management System 1.0. The file /admin/?page=room_types is vulnerable to XSS via manipulation of the room argument. The attack can be performed remotely.
Risk Assessment
The risk is the possibility of injecting malicious scripts, which could lead to theft of patient data or admin session hijacking.
Recommendation
It is recommended to update the system to the latest version or apply proper input filters.
Other vulnerabilities in Hospitals Patient Records Management System
See all- CVE-2026-10185High
An SQL injection vulnerability was found in SourceCodester Hospitals Patient Records Management System 1.0 in the file /classes/Users.php?f=save via the ID argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-10184High
An SQL injection vulnerability was found in SourceCodester Hospitals Patient Records Management System 1.0 in the file /classes/Users.php?f=delete via the ID argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-9564Low
A cross-site scripting vulnerability was found in the Hospitals Patient Records Management System version 1.0 in the file /admin/?page=patients/view_patient. Manipulation of the Remarks argument allows remote script injection. The exploit is publicly available.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Hospitals Patient Records Management System 1.0. This issue affects some unknown processing of the file /admin/?page=room_types. Performing a manipulation of the argument room results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS