{"id":"CVE-2026-116482","kind":"vulnerability","aliases":["CVE-2026-116482"],"related":[],"title":"Online clinic management system: XSS in patient registration page via pat_name","description":"A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected is an unknown function of the file patientregistration.php. Such manipulation of the argument pat_name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The subhajitkhan online clinic management system does not sanitize the pat_name argument in patientregistration.php, so attacker-supplied script can run in a visitor's browser. The exploit is public, and the project has not responded to the early issue report.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["clinic-management","healthcare","other","php","self-hosted"],"not_affected_if":["page-not-deployed","patched-fork"],"how_to_check":"- Look for `patientregistration.php` in the deployed application and check whether the `pat_name` input is echoed back without encoding\n- Confirm whether the deployed code matches commit `e9ee77a8827a1446220fa07ee693dc4d9a29a578` or an earlier state (the project does not use versions)","fix":null,"status":"open","published_at":"2026-10-26T20:17:55+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","triaged_at":"2026-10-26T20:51:58+00:00","updated_at":"2026-10-26T20:51:58+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-26T20:51:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Online clinic management system: XSS in patient registration page via pat_name","impact":"medium","summary":"The subhajitkhan online clinic management system does not sanitize the pat_name argument in patientregistration.php, so attacker-supplied script can run in a visitor's browser. The exploit is public, and the project has not responded to the early issue report.","category":"other","nicknames":[],"who_cares":["php","self-hosted","healthcare","clinic-management"],"confidence":0.6,"needs_auth":"unknown","worst_case":"script runs in visitor browsers, session cookies may be stolen","analyst_note":"Find whether the upstream project has a fix or a maintained fork, and whether the registration page requires login; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116482.","how_to_check":"- Look for `patientregistration.php` in the deployed application and check whether the `pat_name` input is echoed back without encoding\n- Confirm whether the deployed code matches commit `e9ee77a8827a1446220fa07ee693dc4d9a29a578` or an earlier state (the project does not use versions)","needs_analyst":true,"not_affected_if":["patched-fork","page-not-deployed"],"who_is_affected":"Any deployment of the online clinic management system from this repository up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 that exposes patientregistration.php to users is exposed, since the flaw is in the patient registration form handling. Teams running a patched fork or a copy that does not include this page can skip it. The sources do not say whether the page is reachable without login.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000645,"input_tokens":3390,"output_tokens":612,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116482':15A,18A '-2026':14A,17A 'affect':85C,135C 'argument':40B,98C 'attack':45B,107C 'attacker-suppli':44B 'browser':54B 'clinic':2A,20B,31B,79C 'clinic-manag':19B 'cross':103C 'cve':13A,16A 'disclos':116C 'e9ee77a8827a1446220fa07ee693dc4d9a29a578':84C 'earli':67B,148C 'exploit':56B,113C 'file':92C 'found':74C 'function':89C 'healthcar':22B 'host':27B 'inform':133C,144C 'issu':68B,151C 'launch':110C 'lead':101C 'manag':3A,21B,32B,80C 'manipul':95C 'may':121C 'name':12A,39B,100C 'onlin':1A,30B,78C 'online-clinic-management-system':77C 'page':9A 'pat':11A,38B,99C 'patient':7A 'patientregistration.php':42B,93C 'php':24B 'problem':147C 'product':125C 'project':61B,142C 'public':58B,119C 'registr':8A 'releas':138C 'remot':111C 'report':69B,152C 'respond':64B,156C 'run':49B 'sanit':36B 'script':47B,105C 'self':26B 'self-host':25B 'site':104C 'subhajitkhan':29B,76C 'suppli':46B 'system':4A,33B,81C 'unaffect':137C 'unavail':140C 'unknown':88C 'use':123C,128C 'version':129C 'via':10A 'visitor':52B 'vulner':71C 'xss':5A 'yet':157C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of the online clinic management system from this repository up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 that exposes patientregistration.php to users is exposed, since the flaw is in the patient registration form handling. Teams running a patched fork or a copy that does not include this page can skip it. The sources do not say whether the page is reachable without login.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T20:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116482","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116482","severity":null,"published_at":"2026-10-26T20:17:55+00:00","modified_at":"2026-10-26T20:17:55+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","fetched_at":"2026-10-26T20:50:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}