Is there a public PoC exploit available for CVE-2026-9564?

Yes, a public proof-of-concept exploit is available for CVE-2026-9564. Prioritise patching immediately. EPSS: 0.0%.

Patient Records System CVE-2026-9564

Q: What is the CVSS score of CVE-2026-9564?

CVE-2026-9564 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31864 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-26 VulDB

GHSA-hjcg-j78j-2g64

XSS Hospitals Patient Records Management System

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:36 vuln.today

CVSS changed

May 26, 2026 - 17:22 NVD

2.4 (LOW) 1.9 (LOW)

DescriptionCVE.org

A vulnerability was found in SourceCodester/oretnom23 Hospitals Patient Records Management System 1.0. The impacted element is an unknown function of the file /admin/?page=patients/view_patient. Performing a manipulation of the argument Remarks results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

AnalysisAI

Stored cross-site scripting in SourceCodester Hospitals Patient Records Management System 1.0 allows a remote, high-privileged attacker to inject malicious script via the Remarks argument on the /admin/?page=patients/view_patient endpoint, resulting in low-integrity impact when a victim administrator views the affected patient record. A public proof-of-concept exploit exists (GitHub issue), though the CVSS 4.0 base score of 1.9 and EPSS of 0.03% (8th percentile) indicate low real-world exploitation likelihood. This is not listed in the CISA KEV catalog and SSVC classifies it as non-automatable with partial technical impact.

Technical ContextAI

The affected product is a PHP-based hospital administration application developed by SourceCodester (also attributed to oretnom23), identified via CPE strings cpe:2.3:a:sourcecodester:hospitals_patient_records_management_system:*:*:*:*:*:*:*:* and cpe:2.3:a:oretnom23:hospitals_patient_records_management_system:*:*:*:*:*:*:*:*. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), meaning user-supplied input to the Remarks field is not sanitized or encoded before being rendered in HTML context. The CVSS 4.0 vector (E:P) confirms a proof-of-concept exists. The attack vector is network-based (AV:N) with low attack complexity (AC:L) and no special attack preconditions (AT:N), but requires high privileges (PR:H) and passive victim interaction (UI:P), which significantly constrains the attack surface to authenticated admin sessions.

RemediationAI

No vendor-released patch has been identified at time of analysis. SourceCodester/oretnom23 projects are typically open-source community tools without formal patch channels. Administrators should apply output encoding to all user-controlled fields rendered in HTML - specifically the Remarks field in the patient view template - using the hosting language's HTML encoding functions (e.g., htmlspecialchars() in PHP). As a compensating control, restrict access to the admin panel (/admin/) to trusted internal network ranges or VPN only, reducing exposure to network-based exploitation. Input validation should be added server-side to reject or sanitize script-bearing content in the Remarks parameter. The VulDB entry at https://vuldb.com/vuln/365626 and the POC at https://github.com/Alanener/sysy/issues/1 provide additional technical context for developers implementing a fix. There are no known side effects of adding output encoding beyond minor rendering changes if existing data contains intentional HTML markup.