CVE-2026-9564: Hospital Patient Records System XSS Flaw

CVE-2026-9564 Overview

CVE-2026-9564 is a cross-site scripting (XSS) vulnerability [CWE-79] in SourceCodester/oretnom23 Hospitals Patient Records Management System 1.0. The flaw resides in the /admin/?page=patients/view_patient endpoint, where the Remarks parameter is not properly sanitized before being rendered. An authenticated remote attacker can inject arbitrary JavaScript that executes in the browser of any administrator viewing the affected patient record.

Critical Impact

Public exploit details are available, allowing attackers with administrative access to inject persistent JavaScript into patient records and target other admin users viewing those records.

Affected Products

• SourceCodester Hospitals Patient Records Management System 1.0
• oretnom23 Hospitals Patient Records Management System 1.0
• Component: /admin/?page=patients/view_patient (Remarks field)

Discovery Timeline

• 2026-05-26 - CVE-2026-9564 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9564

Vulnerability Analysis

The vulnerability is a stored cross-site scripting issue affecting the patient view administration page. The application accepts user-supplied content in the Remarks argument and stores it without sanitization or output encoding. When an administrator subsequently opens /admin/?page=patients/view_patient, the unescaped content renders in the HTML response, executing any embedded JavaScript in the administrator's session context.

Exploitation requires authenticated access (PR:H) and user interaction (UI:P), which limits practical impact. Confirmed effects are limited to integrity loss in the browser context — session token theft, UI manipulation, or forced administrative actions through the victim's session. The EPSS probability is currently low, but a public proof-of-concept has been disclosed through VulDB and GitHub.

Root Cause

The root cause is missing input validation and output encoding on the Remarks field within the patient records workflow. The application trusts admin-supplied input and reflects it directly into the rendered HTML page without applying HTML entity encoding or a context-aware sanitizer. This matches the [CWE-79] pattern of improper neutralization of input during web page generation.

Attack Vector

The attack vector is network-based against the web application's admin interface. An attacker who has acquired administrative credentials, or who can coerce a privileged user to submit crafted data, stores a malicious payload in the Remarks field of a patient record. The payload executes whenever another admin opens the affected view_patient page. See the GitHub Issue Discussion and VulDB Vulnerability #365626 for technical reproduction details.

No verified code examples are available. The vulnerability manifests when user-controlled text in the Remarks parameter is rendered into the HTML body of the patient view page without escaping.

Detection Methods for CVE-2026-9564

Indicators of Compromise

• Patient records containing HTML tags such as <script>, <img onerror=...>, or <svg> in the Remarks field.
• HTTP POST requests to /admin/?page=patients/manage_patient or related update endpoints with script-like payloads in the Remarks parameter.
• Unexpected outbound HTTP requests from admin browser sessions immediately after viewing a patient record.

Detection Strategies

• Review the patient records database for Remarks field values containing angle brackets, javascript: schemes, or event handler attributes.
• Enable verbose web server access logging on the /admin/?page=patients/view_patient route and search for encoded payload patterns.
• Deploy a web application firewall ruleset that flags XSS signatures targeting POST parameters in the patient management workflow.

Monitoring Recommendations

• Monitor administrator session activity for anomalous DOM-initiated requests after loading patient detail pages.
• Alert on admin account creation, password changes, or privilege modifications that follow a patient record view.
• Track repeated submissions to the patient update endpoint from a single account within short time windows.

How to Mitigate CVE-2026-9564

Immediate Actions Required

• Restrict access to the /admin/ interface to trusted networks or VPN-only ranges until a fix is applied.
• Audit all existing patient records for malicious content in the Remarks field and sanitize stored values.
• Rotate administrator credentials and invalidate active sessions if exposure is suspected.

Patch Information

No official vendor patch is referenced in the NVD entry at the time of publication. SourceCodester and oretnom23 projects are community-maintained, and fixes are typically distributed through repository updates. Track the GitHub Issue Discussion and VulDB Vulnerability #365626 for any vendor-supplied remediation. Until a patch is available, apply the workarounds below.

Workarounds

• Implement server-side HTML entity encoding on the Remarks field before storage and on render in the view_patient template.
• Apply a Content Security Policy (CSP) header that disallows inline scripts and restricts script sources to a trusted allowlist.
• Add a server-side input filter that rejects <, >, and javascript: patterns in the Remarks parameter at submission time.
• Enforce the HttpOnly and SameSite=Strict flags on session cookies to reduce session theft impact from script execution.

# Example CSP header to mitigate stored XSS in PHP/Apache deployments
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Header always set X-XSS-Protection "1; mode=block"
Header always edit Set-Cookie ^(.*)$ "$1; HttpOnly; Secure; SameSite=Strict"