What is the CVSS score of CVE-2026-3817?

CVE-2026-3817 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-3817?

Yes, a public proof-of-concept exploit is available for CVE-2026-3817. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-3817?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Patients Waiting Area Queue Management System CVE-2026-3817

MEDIUM

Incorrect Privilege Assignment (CWE-266)

2026-03-09 cna@vuldb.com

PHP Patients Waiting Area Queue Management System Pamzey

5.3

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-266 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Privilege assignment review
Impact	CVSS 5.3 (MEDIUM). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitable via remote/network. Public exploit/POC available.
Exploit ScenarioDerived	A remote attacker could exploit this flaw, improper authorization.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Patients Waiting Area Queue Management System versions up to 1.0 contains a security vulnerability (CVSS 5.3).

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

affects Patients Waiting Area Queue Management System. was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. This issue affects some unknown processing of the file /patient-search.php. The manipulation results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used.

Know when Patients Waiting Area Queue Management System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

PoC Detected

Mar 09, 2026 - 15:03 vuln.today

Public exploit code

CVE Published

Mar 09, 2026 - 12:16 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. This issue affects some unknown processing of the file /patient-search.php. The manipulation results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used.

Executive ViewAI

Why It Matters

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-3817 rated CVSS 5.3. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low

Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

EPSS Score

0.0%

Top 99% exploitable

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Low

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Affected Products (CPE)CVE.org

cpe:2.3:a:pamzey:patients_waiting_area_queue_management_system:1.0:*:*:*:*:*:*:*

More in Patients Waiting Area Queue Management System

View all

CVE-2025-64081 CRITICAL Act Now POC

9.8 Dec 08

SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management Sy

CVE-2025-13122 MEDIUM This Month POC

5.5 Nov 13

A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. Rated medium severity

CVE-2025-13248 MEDIUM This Month POC

5.5 Nov 16

A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. Rated medium severit

CVE-2026-4617 MEDIUM This Month POC

5.5 Mar 24

SourceCodester Patients Waiting Area Queue Management System 1.0 contains an improper authorization flaw in the Validate

CVE-2026-2154 LOW Monitor POC

2.1 Feb 08

Patients Waiting Area Queue Management System versions up to 1.0 is affected by cross-site scripting (xss) (CVSS 4.3).

CVE-2026-3724 LOW Monitor POC

2.1 Mar 08

Patients Waiting Area Queue Management System versions up to 1.0 contains a security vulnerability (CVSS 6.3).

CVE-2026-2150 LOW Monitor POC

2.1 Feb 08

Patients Waiting Area Queue Management System versions up to 1.0 is affected by cross-site scripting (xss) (CVSS 4.3).

CVE-2026-2149 LOW Monitor POC

2.1 Feb 08

Patients Waiting Area Queue Management System versions up to 1.0 is affected by cross-site scripting (xss) (CVSS 4.3).

CVE-2026-3171 LOW Monitor POC

2.0 Feb 25

Patients Waiting Area Queue Management System versions up to 1.0 is affected by cross-site scripting (xss) (CVSS 3.5).

CVE-2026-3170 LOW Monitor POC

1.9 Feb 25

Patients Waiting Area Queue Management System versions up to 1.0 is affected by cross-site scripting (xss) (CVSS 2.4).

CVE-2026-1148 MEDIUM This Month

4.3 Jan 19

Patients Waiting Area Queue Management System versions up to 1.0 is affected by cross-site request forgery (csrf) (CVSS

CVE-2026-1147 LOW Monitor

2.0 Jan 19

Patients Waiting Area Queue Management System versions up to 1.0 is affected by cross-site scripting (xss) (CVSS 3.5).

Same weakness CWE-266 – Incorrect Privilege Assignment

View all

CVE-2025-27007 CRITICAL POC

9.8

CVE-2024-28000 CRITICAL POC

9.8

CVE-2026-48172 CRITICAL POC

10.0

CVE-2024-24882 CRITICAL POC

9.8

CVE-2025-47539 CRITICAL POC

9.8

CVE-2022-20759 HIGH POC

8.8

CVE-2024-54363 CRITICAL

9.8

CVE-2026-23550 CRITICAL POC

9.8

References

Advisories & patches

REF https://vuldb.com/?ctiid.349783 REF https://vuldb.com/?id.349783 REF https://vuldb.com/?submit.769535 REF https://www.sourcecodester.com/

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back