CVE-2026-3170 - Vulnerability Analysis

Overview

SourceCodester Patrick Mvuma Patients Waiting Area Queue Management System 1.0 contains a stored XSS caused by manipulation of the First Name/Last Name argument in /patient-search.php, letting remote attackers execute scripts, exploit requires crafted input.

Severity & Score

Impact

Remote attackers can execute arbitrary scripts in users' browsers, potentially stealing session data or performing actions on behalf of users.

Mitigation

Update to the latest version or apply patches that sanitize user input in /patient-search.php.

References

• https://gist.github.com/archana1122m/e2953222b47c29c8c69855f5d623267d
• https://vuldb.com/?ctiid.347677
• https://vuldb.com/?id.347677
• https://vuldb.com/?submit.759845

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner