CVE-2026-11468: SourceCodester Hospitals Patient Records Management System page room_types cross site scripting
A vulnerability was detected in SourceCodester Hospitals Patient Records Management System 1.0. This issue affects some unknown processing of the file /admin/?page=roomtypes. Performing a manipulation of the argument room results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Hospitals Patient Records Management System 1.0from your environment.If the application is not required, take it offline or uninstall it until a code fix or patch addressing the XSS in /admin/?page=room_types is implemented.
- Configuration
Implement server-side input validation and proper output encoding/escaping for the 'room' parameter to neutralize XSS payloads before rendering in any HTML context.
SourceCodester Hospitals Patient Records Management System (admin page: /admin/?page=room_types) room parameter input handling = server-side validation and output encoding - Compensating control
Restrict access to the administration interface (including /admin/?page=room_types) to trusted IP ranges or require access via VPN/internal network. Deploy WAF rules to detect and block XSS payloads targeting the 'room' parameter.
- Operational
Review webserver and application logs for signs of exploitation, remove any injected malicious content, and if compromise is suspected rotate administrative session tokens and passwords and notify stakeholders.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11468?
CVE-2026-11468 has a severity rating of low, with a score of 2.4.
How do I fix CVE-2026-11468?
To fix CVE-2026-11468, implement input validation and sanitization for the 'room' parameter to prevent cross site scripting.
What type of vulnerability is CVE-2026-11468?
CVE-2026-11468 is a cross site scripting (XSS) vulnerability found in the SourceCodester Hospitals Patient Records Management System.
What software is affected by CVE-2026-11468?
CVE-2026-11468 affects SourceCodester Hospitals Patient Records Management System version 1.0.
Where is the vulnerability located in CVE-2026-11468?
The vulnerability in CVE-2026-11468 is located in the file /admin/?page=room_types.