What is the CVSS score of CVE-2026-36388?

CVE-2026-36388 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

PHPGurukal Hospital Management System CVE-2026-36388

EUVD-2026-28392 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-07 mitre

GHSA-6f5m-3x87-fcxh

XSS PHP N A

5.4

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 18:00 vuln.today

CVSS changed

May 07, 2026 - 16:22 NVD

5.4 (MEDIUM)

CVE Published

May 07, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 07, 2026 - 00:00 nvd

MEDIUM 5.4

DescriptionCVE.org

A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms/edit-profile.php page. This flaw allows an authenticated attacker (patient) to inject a malicious script payload into the User Name parameter, which is stored in the application and later rendered in the doctor s interface.

AnalysisAI

Stored Cross-Site Scripting in PHPGurukal Hospital Management System v4.0 allows authenticated patients to inject malicious scripts via the User Name parameter on the edit-profile.php page, with the payload later executed in the doctor's interface. The vulnerability requires user interaction (doctor viewing the profile) and affects confidentiality and integrity with limited scope. No public exploit code or active exploitation has been confirmed at analysis time.

Technical ContextAI

This is a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability in a PHP-based hospital management application. The flaw occurs in /hospital/hms/edit-profile.php where user-supplied input in the User Name parameter is not properly sanitized or HTML-encoded before storage in the backend database. When the doctor's interface retrieves and renders this stored data, the malicious script executes in the doctor's browser context with the doctor's session privileges. This is a classic stored XSS pattern where the injection point (patient profile edit) and execution context (doctor viewing) are separated, increasing the attack surface and dwell time.

RemediationAI

Apply a security patch from PHPGurukal when available via http://phpgurukal.com. Until a vendor patch is released, implement immediate compensating controls: (1) Apply HTML entity encoding (htmlspecialchars() with ENT_QUOTES flag in PHP) to all user-supplied input before output in the doctor's interface, specifically targeting the User Name field and any other user-editable fields rendered in admin/doctor views; (2) Implement Content Security Policy (CSP) headers with strict directives (default-src 'self'; script-src 'self') to restrict inline script execution even if XSS payload bypasses input filtering; (3) Disable or restrict the patient profile edit functionality until patching is feasible, as the /edit-profile.php endpoint is the direct injection vector; (4) Input validation: whitelist acceptable characters in the User Name field (alphanumeric, spaces, hyphens only) and reject submissions exceeding reasonable length; (5) Use a PHP security library such as HTML Purifier to strip malicious markup before storage. Each control introduces trade-offs: entity encoding may display user names awkwardly if they contain special characters; CSP may break legitimate inline scripts if the application relies on them; disabling profile editing impacts usability; input validation may reject legitimate names from non-Latin scripts.