CVE-2026-86301: Hospital Information System XSS Vulnerability

CVE-2026-86301 Overview

CVE-2026-86301 is a reflected cross-site scripting (XSS) vulnerability in code-projects Hospital Information System 1.0. The flaw resides in the Patient Management component, specifically the /HIS/src/patients/editPatient.php script. Attackers can manipulate the id parameter to inject arbitrary JavaScript that executes in a victim's browser session.

The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. Exploitation requires low privileges and user interaction, and the exploit has been publicly disclosed.

Critical Impact
An authenticated attacker can craft a malicious URL that, when opened by a legitimate user, executes attacker-controlled script in the context of the Hospital Information System, enabling session theft or unauthorized actions on patient records.

Affected Products

code-projects Hospital Information System 1.0
Component: Patient Management (/HIS/src/patients/editPatient.php)
Parameter: id

Discovery Timeline

2026-09-07 - CVE-2026-86301 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86301

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the editPatient.php endpoint of the Hospital Information System 1.0. The application accepts an id request parameter and reflects its value into the HTTP response without proper output encoding or input sanitization. An attacker who can convince a logged-in user to visit a crafted link causes the browser to execute injected JavaScript within the application's origin.

Because the attack executes in the victim's authenticated session, the attacker inherits the victim's privileges within the Hospital Information System. Potential outcomes include session cookie exfiltration, unauthorized modification of patient records through forged requests, and phishing content injected into a trusted medical application.

Root Cause

The root cause is improper neutralization of user-supplied input before it is placed into HTML output [CWE-79]. The id parameter is written into the page without HTML entity encoding or context-aware escaping, allowing markup and script content to break out of the intended data context.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL pointing to /HIS/src/patients/editPatient.php with a malicious payload embedded in the id parameter. When a victim with an active session opens the link, the payload renders and executes in their browser. Refer to the GitHub CVE analysis and the VulDB entry for CVE-2026-86301 for the disclosed proof of concept.

No verified sanitized exploit code is available for republication. The published proof of concept demonstrates standard XSS payload delivery through the vulnerable query parameter.

Detection Methods for CVE-2026-86301

Indicators of Compromise

Web server access logs containing requests to /HIS/src/patients/editPatient.php where the id parameter includes HTML tags, <script> fragments, javascript: URIs, or event handlers such as onerror= and onload=.
URL-encoded payload artifacts like %3Cscript%3E, %3Cimg, or %22%3E appearing in the id query string.
Unexpected outbound browser connections from clinician workstations to attacker-controlled domains shortly after accessing the patient edit page.

Detection Strategies

Deploy Web Application Firewall (WAF) rules to inspect the id parameter on the vulnerable endpoint for XSS signatures and reject requests containing script markup.
Enable content inspection on proxy or endpoint telemetry to correlate reflected script content in HTTP responses returned from the Hospital Information System.
Hunt historical web logs for anomalous id values that deviate from expected numeric patient identifiers.

Monitoring Recommendations

Alert on any HTTP GET or POST to editPatient.php where the id parameter length exceeds normal identifier size or contains non-numeric characters.
Monitor browser telemetry for JavaScript executions originating from the Hospital Information System origin that trigger cookie access or cross-origin requests.
Track user-clicked email or messaging links that resolve to the HIS application with unusual query strings.

How to Mitigate CVE-2026-86301

Immediate Actions Required

Restrict access to the Hospital Information System to trusted internal networks until a patch is available.
Instruct users to avoid clicking untrusted links referencing the HIS application and to authenticate only through bookmarked URLs.
Deploy WAF signatures that block XSS payloads targeting the id parameter of /HIS/src/patients/editPatient.php.

Patch Information

No vendor advisory or official patch has been published for CVE-2026-86301 at the time of writing. Consult the VulDB vulnerability record #399465 and the code-projects site for future updates. Organizations should apply source-level fixes by validating that the id parameter is strictly numeric and by HTML-encoding any user-controlled data reflected into responses.

Workarounds

Add server-side input validation to editPatient.php that rejects any id value not matching an expected integer format.
Apply context-aware output encoding using PHP functions such as htmlspecialchars($id, ENT_QUOTES, 'UTF-8') before echoing the parameter into HTML.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins.
Set HttpOnly and Secure attributes on session cookies to limit impact of successful script execution.

bash

# Example Apache mod_security rule to block script payloads in the id parameter
SecRule ARGS:id "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1008630,phase:2,deny,status:403,msg:'XSS attempt on editPatient.php id parameter (CVE-2026-86301)'"