CVE-2026-9564
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A cross-site scripting vulnerability was found in the Hospitals Patient Records Management System version 1.0 in the file /admin/?page=patients/view_patient. Manipulation of the Remarks argument allows remote script injection. The exploit is publicly available.
Risk Assessment
An attacker can remotely execute malicious scripts in the administrator's browser, potentially leading to theft of patient data or administrative session hijacking.
Recommendation
Immediately update the system to the latest version or apply a patch that prevents XSS (e.g., input validation and output encoding).
Original NVD description (English source)
A vulnerability was found in SourceCodester/oretnom23 Hospitals Patient Records Management System 1.0. The impacted element is an unknown function of the file /admin/?page=patients/view_patient. Performing a manipulation of the argument Remarks results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used.