Is there a public PoC exploit available for CVE-2026-11468?

Yes, a public proof-of-concept exploit is available for CVE-2026-11468. Prioritise patching immediately. EPSS: 0.0%.

Hospital Records System CVE-2026-11468

Q: What is the CVSS score of CVE-2026-11468?

CVE-2026-11468 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34999 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-07 VulDB

GHSA-84jr-36wf-2f63

XSS Hospitals Patient Records Management System

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 08, 2026 - 00:22 NVD

2.4 (LOW) 1.9 (LOW)

Analysis Generated

Jun 07, 2026 - 23:59 vuln.today

DescriptionCVE.org

A vulnerability was detected in SourceCodester Hospitals Patient Records Management System 1.0. This issue affects some unknown processing of the file /admin/?page=room_types. Performing a manipulation of the argument room results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.

AnalysisAI

Stored or reflected cross-site scripting in SourceCodester Hospitals Patient Records Management System 1.0 allows a remote, authenticated administrator to inject malicious client-side scripts via the unvalidated room argument at the /admin/?page=room_types endpoint. The CVSS score of 2.4 (Low) accurately reflects the constrained conditions: exploitation requires admin-level credentials (PR:H) and victim interaction (UI:R), limiting blast radius to the admin panel. A publicly available proof-of-concept exploit exists via a GitHub issue, but no active exploitation has been confirmed by CISA KEV.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) describes the root cause: the application fails to encode or sanitize user-supplied input in the room parameter before rendering it in the browser. The affected endpoint /admin/?page=room_types processes room type management within the admin interface of a PHP-based web application. The CPE string (cpe:2.3:a:sourcecodester:hospitals_patient_records_management_system:*:*:*:*:*:*:*:*) uses a wildcard version field, indicating all tracked releases are considered affected. SourceCodester applications are typically open-source, educational-grade PHP projects distributed via sourcecodester.com, commonly deployed in academic or low-resource healthcare environments rather than enterprise settings. The XSS payload executes within the victim's browser session under the application's origin, enabling session token theft or UI manipulation against other admin users.

RemediationAI

No vendor-released patch has been identified at time of analysis - the CVSS temporal remediation level is undefined (RL:X) and no fix version appears in any referenced advisory or commit. As an immediate compensating control, restrict access to the /admin/ directory and specifically the ?page=room_types endpoint to trusted internal IP ranges or VPN-only access at the network or web server layer (e.g., via Apache .htaccess or nginx allow/deny directives); this prevents unauthenticated external access and reduces exposure. As a secondary control, implement server-side output encoding on the room parameter using an appropriate PHP HTML-encoding function (e.g., htmlspecialchars()) before rendering in the page - this directly addresses the CWE-79 root cause. Organizations should also evaluate whether this SourceCodester educational application is appropriate for production healthcare use given its track record of unpatched vulnerabilities. Monitor VulDB at https://vuldb.com/cve/CVE-2026-11468 for vendor patch updates.