Patient Records System CVE-2026-9564

Exploitation requires the attacker to hold a high-privileged (admin) account on the Hospitals Patient Records Management System, as confirmed by the CVSS 4.0 vector component PR:H. The vulnerable endpoint is /admin/?page=patients/view_patient, which is only accessible to authenticated administrators. A passive victim interaction (UI:P) is additionally required - a second privileged user must view the affected patient record for the injected script to execute in their browser context. Exploitation is therefore limited by: (1) the attacker must already possess or compromise an admin credential, (2) a separate victim admin must view the poisoned record, and (3) the admin panel must be network-accessible to the attacker. The application being a SourceCodester demo/community project means it is often deployed without hardened access controls, which marginally increases realistic exposure in unprotected deployments.

Despite a publicly available POC and a network-accessible attack vector, the overall risk is low. The CVSS 4.0 score of 1.9 reflects the high privilege requirement (PR:H) and need for user interaction (UI:P), meaning exploitation requires an authenticated admin account and a second admin or privileged user to view the poisoned patient record. The EPSS score of 0.03% (8th percentile) aligns with this assessment - mass exploitation is implausible. SSVC further classifies the vulnerability as non-automatable with only partial technical impact, reinforcing that this is not a candidate for opportunistic mass exploitation. Integrity impact is limited to the vulnerable system only (VI:L), with no confidentiality or availability consequences. The primary realistic risk is within insider-threat or compromised admin-account scenarios. This vulnerability does not appear in the CISA KEV catalog. There is no apparent conflict between the CVSS signals and the description - both are consistent with a low-severity stored XSS requiring admin access.

An attacker with existing high-privileged (admin) access to the Hospitals PRMS application navigates to a patient record and injects a malicious JavaScript payload into the Remarks field. When a second privileged user - such as another administrator - views that patient's record via /admin/?page=patients/view_patient, the unencoded script executes in their browser session, potentially enabling session token theft or unauthorized UI actions. A public proof-of-concept demonstrating this injection is available via the GitHub issue at https://github.com/Alanener/sysy/issues/1.