Hospital Records System CVE-2026-11468

Exploitation requires the attacker to hold high-privilege (administrator-level) credentials to the application, as confirmed by the CVSS PR:H vector - unauthenticated exploitation is not possible. A second authenticated user must also load the affected page for the XSS payload to execute (UI:R per CVSS), making this a multi-party attack confined to the admin panel. The vulnerable parameter is specifically the room argument processed by the /admin/?page=room_types endpoint; no other parameters or endpoints are identified in available data. No special server-side configuration beyond a standard version 1.0 deployment is required. Exploitation is further limited by the absence of confidentiality impact (C:N), meaning credentials or patient records cannot be directly exfiltrated through this vector alone - the attacker gains only limited integrity impact, such as injecting misleading content or pivoting via session hijacking against other admin users.

The CVSS 2.4 (Low) score is internally consistent and appropriately calibrated for this vulnerability. AV:N confirms remote reachability, but PR:H requires the attacker to already possess administrator credentials - a significant bar that negates most opportunistic threat scenarios. UI:R further reduces risk by requiring a second authenticated admin to load the poisoned page. The scope is unchanged (S:U), and impacts are C:N/I:L/A:N, meaning no data exfiltration is possible and only limited integrity degradation occurs. The temporal vector records E:P (proof-of-concept exploit exists) and RC:R (reasonable but not confirmed confidence), with RL:X indicating no remediation level has been formally defined by the vendor. No EPSS score was provided in source data, so exploitation probability cannot be independently quantified. No CISA KEV listing exists. Overall, this is a low-priority issue for most organizations - real-world risk is low due to the admin credential prerequisite - but deserves attention in healthcare contexts where admin account compromise could enable session hijacking against clinical staff.

An attacker who has obtained admin credentials - through phishing, credential stuffing, or a prior compromise - authenticates to the admin panel and navigates to /admin/?page=room_types, submitting a crafted room value containing a JavaScript payload such as a cookie-stealing script. When a second administrator loads the room types page, the injected script executes in their browser, potentially exfiltrating their session token to an attacker-controlled server. A public proof-of-concept demonstrating this technique is available at https://github.com/jqr1449186277/CVE/issues/2.