Cross-Site Scripting Vulnerability in Hospital Information System by Code-Projects
CVE-2026-86301

5.1MEDIUM

Key Information:

Vendor

Code-projects

Status
Hospital Information System
Vendor
CVE Published:
7 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-86301?

A cross-site scripting vulnerability exists in the Hospital Information System (HIS) 1.0, particularly within the Patient Management component found at /HIS/src/patients/editPatient.php. The vulnerability allows attackers to manipulate the 'ID' argument, potentially enabling remote exploitation through crafted requests. This could result in unauthorized access to sensitive information or the injection of malicious scripts into web pages, compromising user security. The exploit has already been disclosed publicly, raising significant security concerns for users of this system.

Affected Version(s)

Hospital Information System 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-86301 - Proof of Concept

References

https://vuldb.com/vuln/399465
vdb-entrytechnical-description
https://vuldb.com/vuln/399465/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-86301
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

AhmadMarzouk (VulDB User)
.