CVE-2026-36388

A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms/edit-profile.php page. This flaw allows an authenticated attacker (patient) to inject a malicious script payload into the User Name parameter, which is stored in the application and later rendered in the doctor s interface.

Score
CVSS 3.1 5.4 Medium
Status
Deferred - cve@mitre.org
Published
2026-05-07
Last modified
2026-07-05
Weaknesses
CWE-79

References

 
 
© AVABIS GmbH privacypolicy about