CVE-2026-9564: SourceCodester/oretnom23 Hospitals Patient Records Management System view_patient cross site scripting

Published May 26, 2026

Updated

A vulnerability was found in SourceCodester/oretnom23 Hospitals Patient Records Management System 1.0. The impacted element is an unknown function of the file /admin/?page=patients/viewpatient. Performing a manipulation of the argument Remarks results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Affected Software

1 affected component

Sourcecodester oretnom23 Hospitals Patient Records Management System=1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove SourceCodester/oretnom23 Hospitals Patient Records Management System /admin/?page=patients/view_patient from your environment.
Temporarily disable or remove the /admin/?page=patients/view_patient page (or disable rendering of the Remarks field) until a secure fix is implemented.
Configuration
Validate and sanitize the 'Remarks' parameter on the server side and ensure all data is HTML-encoded or escaped before rendering in /admin/?page=patients/view_patient to prevent stored/reflected XSS.
SourceCodester/oretnom23 Hospitals Patient Records Management System (view_patient) Remarks input/output handling = Validate input and HTML-encode/escape output
Compensating control
Restrict access to /admin/?page=patients/view_patient to trusted IPs or internal networks and/or deploy WAF rules to detect and block XSS payloads targeting the 'Remarks' parameter until the vulnerability is fixed.
Operational
Search application and web server logs for evidence of exploitation of the 'Remarks' parameter, perform incident response if compromise is suspected, and apply the appropriate fix when it becomes available.

Event History

May 26, 2026

CVE Published

via MITRE·04:30 PM

Data Sourced

via MITRE·04:30 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeakness

Jun 29, 58424

Event

via FIRST·03:26 PM

Frequently Asked Questions

What is the severity of CVE-2026-9564?

The severity of CVE-2026-9564 is classified as low with a score of 2.4.

How do I fix CVE-2026-9564?

To fix CVE-2026-9564, input validation and sanitization mechanisms should be implemented for the 'Remarks' argument in the affected functionality.

What type of vulnerability is CVE-2026-9564?

CVE-2026-9564 is a cross site scripting (XSS) vulnerability.

What is affected by CVE-2026-9564?

CVE-2026-9564 affects the 'view_patient' function in the SourceCodester/oretnom23 Hospitals Patient Records Management System.

Can CVE-2026-9564 be exploited remotely?

Yes, CVE-2026-9564 can be exploited remotely through manipulation of the 'Remarks' argument.