CVE-2026-9564
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A cross-site scripting vulnerability was found in the Hospitals Patient Records Management System version 1.0 in the file /admin/?page=patients/view_patient. Manipulation of the Remarks argument allows remote script injection. The exploit is publicly available.
Risk Assessment
An attacker can remotely execute malicious scripts in the administrator's browser, potentially leading to theft of patient data or administrative session hijacking.
Recommendation
Immediately update the system to the latest version or apply a patch that prevents XSS (e.g., input validation and output encoding).
Other vulnerabilities in Hospitals Patient Records Management System
See all- CVE-2026-11468Low
Vulnerability in SourceCodester Hospitals Patient Records Management System 1.0. The file /admin/?page=room_types is vulnerable to XSS via manipulation of the room argument. The attack can be performed remotely.
- CVE-2026-10185High
An SQL injection vulnerability was found in SourceCodester Hospitals Patient Records Management System 1.0 in the file /classes/Users.php?f=save via the ID argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-10184High
An SQL injection vulnerability was found in SourceCodester Hospitals Patient Records Management System 1.0 in the file /classes/Users.php?f=delete via the ID argument. The attack can be executed remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was found in SourceCodester/oretnom23 Hospitals Patient Records Management System 1.0. The impacted element is an unknown function of the file /admin/?page=patients/view_patient. Performing a manipulation of the argument Remarks results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS