CVE-2026-36324: XSS
SourceCodester Doctor Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) due to improper handling of user supplied input in the user registration functionality in register.php.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix register.php to perform strict server-side validation and sanitization of all user-supplied input and apply appropriate output encoding/escaping before rendering to pages to prevent Cross-Site Scripting (XSS).
SourceCodester Doctor Appointment System (register.php) input_handling = validate_and_sanitize_and_output_encode - Compensating control
Deploy a web application firewall (WAF) or input-filtering rules to block common XSS payloads targeting the registration endpoint (register.php) until the application code is remediated.
- Operational
Audit existing registration-related stored data for injected scripts or malicious payloads and remove or sanitize any discovered content that could trigger XSS in rendered pages.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-36324?
CVE-2026-36324 has a risk severity score of 32.
What type of vulnerability is CVE-2026-36324?
CVE-2026-36324 is a Cross Site Scripting (XSS) vulnerability.
How do I fix CVE-2026-36324?
To fix CVE-2026-36324, ensure proper sanitization and validation of user input in the registration functionality of the application.
Which software is affected by CVE-2026-36324?
CVE-2026-36324 affects the SourceCodester Doctor Appointment System version 1.0.
Where is the vulnerability located in CVE-2026-36324?
The vulnerability in CVE-2026-36324 is located in the user registration functionality in register.php.