Is there a public PoC exploit available for EUVD-2026-35060?

Yes, a public proof-of-concept exploit is available for EUVD-2026-35060. Prioritise patching immediately. EPSS: 0.0%.

Hospital Management System EUVD-2026-35060

Q: What is the CVSS score of EUVD-2026-35060?

EUVD-2026-35060 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-11512 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-08 VulDB

GHSA-4h24-fgh6-m47f

PHP XSS Hospital Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:52 vuln.today

Severity Changed

Jun 08, 2026 - 13:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 13:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file /billing.php. The manipulation of the argument patientid leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Cross-site scripting in itsourcecode Hospital Management System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the unsanitized patientid parameter in /billing.php, executing in the context of a victim user's browser session upon interaction with a crafted URL. A publicly available proof-of-concept exploit exists, referenced in GitHub issue #13 of the ltranquility/vuln_submit repository, lowering the barrier for opportunistic exploitation. This CVE is not listed in the CISA KEV catalog; the CVSS 4.0 score of 2.1 reflects limited impact scope - low integrity effect only, no confidentiality or availability loss - constrained further by the passive user interaction requirement.

Technical ContextAI

The affected application is a PHP-based hospital management system developed by itsourcecode (CPE: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*), a vendor known for distributing open-source academic and small-business management applications. The vulnerable component is /billing.php, where the patientid parameter is accepted from user input and reflected in the HTTP response without proper HTML encoding or output sanitization. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) describes this root cause class: the application trusts user-controlled input and embeds it directly into the rendered HTML, enabling browser-side script injection. The wildcard version in the CPE string suggests all known releases of the system share this vulnerable code path.

RemediationAI

No vendor-released patch has been identified at the time of analysis - the itsourcecode vendor site (https://itsourcecode.com/) is referenced but no associated advisory or fixed version appears in the available intelligence, and no patched release version is independently confirmable from the provided data. As a primary compensating control, developers should implement server-side output encoding for the patientid parameter in /billing.php, ensuring all reflected values are HTML-entity-encoded (e.g., using PHP's htmlspecialchars() with ENT_QUOTES) before insertion into the response body. A Web Application Firewall rule that blocks or sanitizes script-injection patterns in the patientid parameter can reduce exposure with minimal operational impact, though WAF rules may produce false positives on legitimate numeric patient ID values and should be tested before deployment. If the application is internet-accessible, restricting the billing module to internal network access only (e.g., via network ACL or VPN requirement) is the highest-confidence mitigation, at the cost of eliminating remote access for legitimate users. Vulnerability details and the POC reference are available at https://vuldb.com/vuln/369132 and https://github.com/ltranquility/vuln_submit/issues/13.