---
id: "CVE-2026-116482"
kind: "vulnerability"
aliases: ["CVE-2026-116482"]
title: "Online clinic management system: XSS in patient registration page via pat_name"
severity: "medium"
cvss: 4.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["clinic-management", "healthcare", "other", "php", "self-hosted"]
not_affected_if: ["page-not-deployed", "patched-fork"]
published_at: "2026-10-26T20:17:55+00:00"
first_seen_at: "2026-10-26T20:50:17+00:00"
updated_at: "2026-10-26T20:51:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116482", "first_seen_at": "2026-10-26T20:50:17+00:00"}]
---

# Online clinic management system: XSS in patient registration page via pat_name

The subhajitkhan online clinic management system does not sanitize the pat_name argument in patientregistration.php, so attacker-supplied script can run in a visitor's browser. The exploit is public, and the project has not responded to the early issue report.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `patientregistration.php` in the deployed application and check whether the `pat_name` input is echoed back without encoding
- Confirm whether the deployed code matches commit `e9ee77a8827a1446220fa07ee693dc4d9a29a578` or an earlier state (the project does not use versions)

## Timeline

- 2026-10-26T20:50:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116482

## From the sources

A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected is an unknown function of the file patientregistration.php. Such manipulation of the argument pat_name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_