Online Clinic Management System EUVD-2026-110313

Exploitation requires reaching the patient registration workflow in patientregistration.php and supplying a crafted value in the pat_name parameter that is later rendered without output encoding (CWE-79). Per the CVSS vector, the attacker needs some privilege level (PR:L, so authentication requirements indicate an authenticated actor) and the attack depends on user interaction (UI:P) - a victim must load the page where the injected pat_name value is displayed. The impact is limited to low integrity (VI:L) with no confidentiality or availability impact per the vector. The flaw is network-reachable (AV:N). The specific deployment configuration and whether the payload is stored or reflected are not described in the available sources; because the product does not use versioning, no version-based limiting condition can be stated.

This is a low-priority, low-real-risk issue despite being a remotely reachable web flaw. The CVSS 4.0 base score is only 2.0, and the vector (AV:N/AC:L/PR:L/UI:P/VC:N/VI:L/VA:N) shows why: it is network-reachable but requires some privileges (PR:L) and user interaction (UI:P), and the only impact is a low integrity effect (VI:L) with no confidentiality or availability impact recorded. The EPSS score of 0.25% (17th percentile) corroborates low expected exploitation, and there is no CISA KEV listing, so there is no evidence of active exploitation. The vuln.today decision label is 'monitor,' consistent with all of these signals pointing in the same low-urgency direction. One data tension worth stating explicitly: the input distinguishes authentication/privilege via PR:L (authenticated), yet the product is a hobby GitHub project with no versioning and no vendor response, so the real-world deployment and threat context is thin. A public PoC reference exists but is not verified as working exploit code, so even the exploit signal is soft. Overall this is a genuinely low-severity, low-urgency finding, not a high-CVSS-but-low-risk mismatch - every independent signal (CVSS, EPSS, no KEV, monitor label) agrees.

An authenticated attacker submits a patient registration via patientregistration.php with a malicious script payload in the pat_name field, which is later rendered without proper output encoding. When another user (such as a clinic staff member) views the affected page, the script executes in their browser session. A public PoC reference exists (a GitHub issue report), but it is not verified as working exploit code, and exploitation requires user interaction (UI:P) and some privilege level (PR:L).