What is the CVSS score of CVE-2026-28137?

CVE-2026-28137 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of QuanticaLabs MediCenter are affected by CVE-2026-28137?

A cross-site scripting (XSS) vulnerability in QuanticaLabs MediCenter could allow attackers to compromise patient data and clinic operations by injecting malicious code into the application.

How to fix or mitigate CVE-2026-28137?

Within 24 hours: inventory all instances of MediCenter in production and isolate high-risk deployments if feasible; notify QuanticaLabs for patch timeline. Within 7 days: implement WAF rules to block XSS payloads, enforce strict Content Security Policy (CSP) headers, and restrict administrative access to the application. Within 30 days: conduct code review of user input handling, implement input validation and output encoding, engage vendor for patch release timeline, and evaluate alternative solutions if no patch is released.

QuanticaLabs MediCenter CVE-2026-28137

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-05 audit@patchstack.com

XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Reflected XSS.This issue affects MediCenter - Health Medical Clinic: from n/a through <= 14.9.

AnalysisAI

QuanticaLabs MediCenter - Health Medical Clinic medicenter is affected by cross-site scripting (xss) (CVSS 7.1).

Technical ContextAI

This vulnerability (CWE-79: Cross-site Scripting (XSS)) affects QuanticaLabs MediCenter - Health Medical Clinic medicenter. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Reflected XSS.This issue affects MediCenter - Health Medical Clinic: from n/a through <= 14.9.

Affected ProductsAI

Product: QuanticaLabs MediCenter - Health Medical Clinic medicenter.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.